chore: v2.8.26 — React 19 / Express 5 / xterm 6, bigger file drops, hidden-tab terminal size fix

fix(drop): stream every dropped file to disk; no local size cap
- POST /api/run/drop-file pipes the body to its file as it arrives in every case — a member's (S3) through `write-as … replace` with the bytes on stdin — instead of buffering up to 20 MB in memory for a remote browser. - Remote limit (server mode, a LAN browser) 20 MB → 500 MB, as a Files upload. - A loopback browser in local mode has no cap any more, only the data dir's free space less a 1 GB reserve; ETOOBIG's max_bytes is what still fits, so the UI's "at most N MB" stays true. - drop-image keeps its 20 MB in-memory limit, now checked on its own. - fake-sudo gains a spawn for run-as.__setSpawnImpl.
2026-10-26 16:36:49 +07:00 · 2026-10-26 16:36:29 +07:00 · 2026-10-26 14:53:29 +07:00 · 2026-10-26 14:43:01 +07:00 · 2026-10-26 14:22:41 +07:00 · 2026-10-26 14:22:18 +07:00
170 changed files with 7400 additions and 3956 deletions
@@ -7,7 +7,7 @@ Architectural overview and technical reference for the Agent Dashboard system, c
 ![Model Context Protocol](https://img.shields.io/badge/Model_Context_Protocol-1.0-0f766e?style=flat-square&logo=modelcontextprotocol&logoColor=white)
 ![Node.js](https://img.shields.io/badge/Node.js-%3E%3D20-339933?style=flat-square&logo=node.js&logoColor=white)
 ![Python](https://img.shields.io/badge/Python-%3E%3D3.6-3776AB?style=flat-square&logo=python&logoColor=white)
-![Express](https://img.shields.io/badge/Express-4.21-000000?style=flat-square&logo=express&logoColor=white)
+![Express](https://img.shields.io/badge/Express-5-000000?style=flat-square&logo=express&logoColor=white)
 ![ws](https://img.shields.io/badge/ws-WebSocket_server-010101?style=flat-square&logo=socketdotio&logoColor=white)
 ![web-push](https://img.shields.io/badge/web--push-VAPID-3b82f6?style=flat-square&logo=javascript&logoColor=white)
 ![swagger-ui-express](https://img.shields.io/badge/swagger--ui--express-5.0-85EA2D?style=flat-square&logo=swagger&logoColor=white)
@@ -2557,7 +2557,7 @@ Components that consume this: SessionDetail, Analytics (donut chart + breakdown)
 | **SQLite** (via `better-sqlite3` or built-in `node:sqlite`) | Zero-config, embedded, no server process. WAL mode gives concurrent reads. Synchronous API is simpler than async alternatives for this use case. Falls back to Node.js built-in `node:sqlite` when `better-sqlite3` cannot be compiled |
 | **Express**                     | Battle-tested, minimal, well-understood. Overkill would be Fastify for this scale; underkill would be raw `http` module                         |
 | **ws**                          | Fastest, most lightweight WebSocket library for Node. No Socket.IO overhead needed since we only push JSON messages                             |
-| **React 18**                    | Stable, widely known, strong TypeScript support. No need for Server Components or RSC given this is a client-rendered SPA                       |
+| **React 19**                    | Stable, widely known, strong TypeScript support. No need for Server Components or RSC given this is a client-rendered SPA                       |
 | **Vite**                        | Fast builds, native ESM, excellent dev experience. Proxy config handles the dev server split cleanly                                            |
 | **Tailwind CSS**                | Utility-first approach keeps styles colocated with markup. No CSS module boilerplate. Colors are CSS-variable-backed tokens (`darkMode: "class"`) so the Dark/Light/System switch re-themes the app with one class flip rather than per-component `dark:` variants, and a named theme (Settings → Appearance) is one `data-theme` attribute selecting an override block of the same variables |
 | **React Router 6**              | Standard routing for React SPAs. Layout routes with `<Outlet>` give clean shell composition                                                     |
@@ -1281,7 +1281,7 @@ async function cmdDoctor() {
  // Asked of the SERVER, not of this shell: a run is a tmux session the server
  // spawns, so the only PATH that decides whether Start Run works is its own —
  // a systemd --user service never reads your shell profile. Missing tmux is a
-  // warning, not a failure: it costs the run console and `lanes shell`, nothing
+  // warning, not a failure: it costs the run console and `workspace shell`, nothing
  // else.
  try {
    const { available, upgrade } = await get("/api/run/tmux");
@@ -1693,7 +1693,7 @@ function cmdOpen() {
 }

 /**
- * `agenthub lanes add` — adopt a working directory or provision a managed worktree.
+ * `agenthub workspace add` — adopt a working directory or provision a managed worktree.
 */
 async function cmdLanesAdd(args) {
  const flag = (name) => {
@@ -1719,12 +1719,12 @@ async function cmdLanesAdd(args) {
    if (base) body.base = base;
    if (slug) body.slug = slug;
    if (tool) body.tool = tool;
-    const { lane: provisioning } = await post("/api/lanes/worktree", body);
+    const { lane: provisioning } = await post("/api/workspaces/worktree", body);
    const deadline = Date.now() + 30_000;
    let lane = provisioning;
    while (lane.status === "provisioning" && Date.now() < deadline) {
      await new Promise((resolve) => setTimeout(resolve, 250));
-      ({ lane } = await get(`/api/lanes/${provisioning.id}`));
+      ({ lane } = await get(`/api/workspaces/${provisioning.id}`));
    }
    if (lane.status === "provisioning") {
      console.error(
@@ -1755,12 +1755,12 @@ async function cmdLanesAdd(args) {
  const body = { cwd, title };
  if (pipeline) body.pipeline = pipeline;
  if (tool) body.tool = tool;
-  const { lane } = await post("/api/lanes", body);
+  const { lane } = await post("/api/workspaces", body);
  console.log(`${c.green("✔")} Created workspace #${lane.id}: ${lane.title}`);
 }

 /**
- * `agenthub lanes gc [--dry-run]` — reap orphaned Playwright MCP processes
+ * `agenthub workspace gc [--dry-run]` — reap orphaned Playwright MCP processes
 * (owning session died) and cap oversized hook logs, across every lane on
 * this machine. Machine-wide, not one lane's; pure local process/file
 * action, no HTTP round-trip.
@@ -1790,7 +1790,7 @@ function cmdLanesGc(args) {
 }

 /**
- * `agenthub lanes profile init <repo>` — detect a Node.js project and scaffold
+ * `agenthub workspace profile init <repo>` — detect a Node.js project and scaffold
 * `.agenthub/profile/`. Pure filesystem action against the SOURCE repo; does not
 * talk to the dashboard server at all.
 */
@@ -1844,9 +1844,9 @@ function cmdLanesProfileInit(args) {
 }

 /**
- * `agenthub lanes profile check [<path>]` — validate a profile without needing a
+ * `agenthub workspace profile check [<path>]` — validate a profile without needing a
 * lane to exist for it yet. Defaults to the current directory, NOT lane-id
- * resolution (unlike every other `lanes` subcommand) — this is meant to run
+ * resolution (unlike every other `workspace` subcommand) — this is meant to run
 * against a bare repo right after `profile init`.
 */
 async function cmdLanesProfileCheck(args) {
@@ -1883,7 +1883,7 @@ function printLaneFacts(title, facts, fields) {
  }
 }

-/** `agenthub lanes reset|remove|purge` — destructive work only after a fact check. */
+/** `agenthub workspace reset|remove|purge` — destructive work only after a fact check. */
 async function cmdLanesLifecycle(action, args) {
  const id = args.find((arg) => !arg.startsWith("--"));
  const fields = LANE_PREFLIGHT_FIELDS[action];
@@ -1894,7 +1894,7 @@ async function cmdLanesLifecycle(action, args) {
    return;
  }

-  const preflight = await get(`/api/lanes/${id}/preflight?action=${action}`);
+  const preflight = await get(`/api/workspaces/${id}/preflight?action=${action}`);
  printLaneFacts(`Preflight for ${action} workspace #${id}:`, preflight, fields);
  const keepDb = action === "reset" && args.includes("--keep-db");
  if (preflight.database) {
@@ -1938,7 +1938,7 @@ async function cmdLanesLifecycle(action, args) {
  const body = { confirm: true, expect };
  if (args.includes("--force")) body.force = true;
  if (keepDb) body.keepDb = true;
-  const result = await post(`/api/lanes/${id}/${action}`, body, { allowError: true });
+  const result = await post(`/api/workspaces/${id}/${action}`, body, { allowError: true });
  if (result.status) {
    const error = result.data?.error || {};
    console.error(`✖ ${action} workspace #${id} → ${error.message || `HTTP ${result.status}`}`);
@@ -1961,7 +1961,7 @@ async function cmdLanesLifecycle(action, args) {
 }

 /**
- * `agenthub lanes` — one row per lane: what it is, where it is in its pipeline, and
+ * `agenthub workspaces` — one row per lane: what it is, where it is in its pipeline, and
 * whether the driving session is still breathing.
 */
 /**
@@ -1993,7 +1993,7 @@ function detectionLeadsDeclaration(l) {
 }

 async function cmdLanes() {
-  const { lanes, counts } = await get("/api/lanes");
+  const { lanes, counts } = await get("/api/workspaces");
  if (!lanes.length) {
    console.log(
      "no workspaces yet — create one with: agenthub workspace add --cwd <path> --title <text>"
@@ -2040,7 +2040,7 @@ function toolFromEnv() {
 *
 * Only the FIRST positional counts as an id, and only when it is all digits.
 * Scanning the whole argv for a number would swallow flag values —
- * `agenthub lanes logs web --tail 4096` would have addressed lane 4096.
+ * `agenthub workspace logs web --tail 4096` would have addressed lane 4096.
 *
 * @param {string[]} args - Arguments after the subcommand.
 * @returns {Promise<{laneId: string|number, rest: string[]}|null>} null once an error is printed.
@@ -2051,13 +2051,13 @@ async function resolveLaneArg(args) {
    return i > -1 ? args[i + 1] : undefined;
  };

-  const explicit = flagValue("lane") || flagValue("workspace");
+  const explicit = flagValue("workspace");
  if (explicit) return { laneId: explicit, rest: args };
  if (args.length && /^\d+$/.test(args[0])) return { laneId: args[0], rest: args.slice(1) };

  const tool = flagValue("tool") || toolFromEnv();
  const cwd = require("path").resolve(flagValue("cwd") || process.cwd());
-  const { lanes } = await get("/api/lanes");
+  const { lanes } = await get("/api/workspaces");

  // A pane's AGENTHUB_LANE_ID beats cwd matching, but only after it is checked
  // against the live lane list AND the directory: a pane outlives the lane it
@@ -2146,7 +2146,7 @@ function printRuntime(runtime) {
 }

 /**
- * `agenthub lanes up|down|runtime|logs|hook` — a lane's own application stack, as
+ * `agenthub workspace up|down|runtime|logs|hook` — a lane's own application stack, as
 * opposed to `start`/`stop`, which drive its Claude run. Two lifecycles, one
 * lane id.
 *
@@ -2160,7 +2160,7 @@ async function cmdLanesRuntime(sub, args) {
  const { laneId, rest: laneArgs } = resolved;

  if (sub === "runtime") {
-    printRuntime(await get(`/api/lanes/${laneId}/runtime`));
+    printRuntime(await get(`/api/workspaces/${laneId}/runtime`));
    return;
  }

@@ -2168,7 +2168,7 @@ async function cmdLanesRuntime(sub, args) {
    const body = {};
    if (laneArgs.includes("--no-build")) body.build = false;
    if (laneArgs.includes("--qc")) body.qc = true;
-    const result = await post(`/api/lanes/${laneId}/up`, body, { allowError: true });
+    const result = await post(`/api/workspaces/${laneId}/up`, body, { allowError: true });
    if (result.status) {
      console.error(`✖ up workspace #${laneId} → ${result.data?.error?.message || result.status}`);
      process.exitCode = 1;
@@ -2181,7 +2181,7 @@ async function cmdLanesRuntime(sub, args) {
    const deadline = Date.now() + 15 * 60 * 1000;
    for (;;) {
      await new Promise((r) => setTimeout(r, 2000));
-      const runtime = await get(`/api/lanes/${laneId}/runtime`);
+      const runtime = await get(`/api/workspaces/${laneId}/runtime`);
      if (runtime.healthy) {
        printRuntime(runtime);
        return;
@@ -2202,7 +2202,7 @@ async function cmdLanesRuntime(sub, args) {
  }

  if (sub === "down") {
-    const result = await post(`/api/lanes/${laneId}/down`, {}, { allowError: true });
+    const result = await post(`/api/workspaces/${laneId}/down`, {}, { allowError: true });
    if (result.status) {
      console.error(
        `✖ down workspace #${laneId} → ${result.data?.error?.message || result.status}`
@@ -2223,7 +2223,7 @@ async function cmdLanesRuntime(sub, args) {
    }
    const i = laneArgs.indexOf("--tail");
    const query = i > -1 && laneArgs[i + 1] ? `?tail=${encodeURIComponent(laneArgs[i + 1])}` : "";
-    const log = await get(`/api/lanes/${laneId}/logs/${encodeURIComponent(svc)}${query}`);
+    const log = await get(`/api/workspaces/${laneId}/logs/${encodeURIComponent(svc)}${query}`);
    if (!log.available) {
      console.log("no logs for this workspace yet.");
      return;
@@ -2241,7 +2241,7 @@ async function cmdLanesRuntime(sub, args) {
      return;
    }
    const result = await post(
-      `/api/lanes/${laneId}/hook/${encodeURIComponent(name)}`,
+      `/api/workspaces/${laneId}/hook/${encodeURIComponent(name)}`,
      { args: laneArgs.slice(1) },
      { allowError: true }
    );
@@ -2263,7 +2263,7 @@ async function cmdLanesRuntime(sub, args) {
        : "merge";
    const branch = laneArgs.find((arg) => !arg.startsWith("--"));
    const result = await post(
-      `/api/lanes/${laneId}/sync-base`,
+      `/api/workspaces/${laneId}/sync-base`,
      { mode, branch },
      { allowError: true }
    );
@@ -2342,7 +2342,7 @@ async function defaultHolder(argsAfterName) {

  const resolved = await resolveLaneArg(argsAfterName);
  if (!resolved) return null;
-  const { lane } = await get(`/api/lanes/${resolved.laneId}`);
+  const { lane } = await get(`/api/workspaces/${resolved.laneId}`);
  return lane.slot ? `lane${lane.slot}` : `lane${lane.id}`;
 }

@@ -2474,7 +2474,7 @@ function fmtFeatureRow(f) {
 async function cmdFeatureList(args) {
  const resolved = await resolveLaneArg(args);
  if (!resolved) return;
-  const { features } = await get(`/api/lanes/${resolved.laneId}/features`);
+  const { features } = await get(`/api/workspaces/${resolved.laneId}/features`);
  if (!features.length) {
    console.log("no features activated yet — start one with: agenthub feature activate <slug>");
    return;
@@ -2496,7 +2496,7 @@ async function cmdFeatureActivate(args) {
  };
  const resolved = await resolveLaneArg(args.filter((a) => a !== slug));
  if (!resolved) return;
-  const { lane, feature } = await post(`/api/lanes/${resolved.laneId}/features/activate`, {
+  const { lane, feature } = await post(`/api/workspaces/${resolved.laneId}/features/activate`, {
    slug,
    title: flag("title"),
  });
@@ -2506,13 +2506,13 @@ async function cmdFeatureActivate(args) {
 }

 /** `agenthub feature show <slug> [<id>] [--cwd path]` — one feature's saved pipeline. */
-/** `agenthub lanes proof-link [<id>] [--cwd path]` — converge the clone-root
+/** `agenthub workspace proof-link [<id>] [--cwd path]` — converge the clone-root
 *  `proof/` onto `.playwright-mcp/proof` (idempotent). Never run automatically
 *  by anything else in this codebase; a session or hook calls it explicitly. */
 async function cmdLanesProofLink(args) {
  const resolved = await resolveLaneArg(args);
  if (!resolved) return;
-  const { linked } = await post(`/api/lanes/${resolved.laneId}/proof-link`);
+  const { linked } = await post(`/api/workspaces/${resolved.laneId}/proof-link`);
  console.log(
    linked
      ? `${c.green("✔")} linked proof/ -> .playwright-mcp/proof`
@@ -2520,13 +2520,13 @@ async function cmdLanesProofLink(args) {
  );
 }

-/** `agenthub lanes mcp sync [<id>] [--cwd path]` — relocate the source repo's
+/** `agenthub workspace mcp sync [<id>] [--cwd path]` — relocate the source repo's
 *  already-configured MCP servers into <lane>/.mcp.json and seed Chromium
 *  profiles. Never run automatically; a session calls it explicitly. */
 async function cmdLanesMcpSync(args) {
  const resolved = await resolveLaneArg(args);
  if (!resolved) return;
-  const result = await post(`/api/lanes/${resolved.laneId}/mcp/sync`, {}, { allowError: true });
+  const result = await post(`/api/workspaces/${resolved.laneId}/mcp/sync`, {}, { allowError: true });
  if (result.status) {
    console.error(`✖ mcp sync → ${result.data?.error?.message || result.status}`);
    process.exitCode = 1;
@@ -2538,7 +2538,7 @@ async function cmdLanesMcpSync(args) {
  }
 }

-/** `agenthub lanes integration <name> [<id>]` — check whether a named
+/** `agenthub workspace integration <name> [<id>]` — check whether a named
 *  integration (tracker, dev_qc, ci_wait) is turned on for this lane, per
 *  its .agenthub/profile/integrations.env. Exit 0 = on, 1 = off. */
 async function cmdLanesIntegration(args) {
@@ -2551,13 +2551,13 @@ async function cmdLanesIntegration(args) {
  const resolved = await resolveLaneArg(args.filter((a) => a !== name));
  if (!resolved) return;
  const { enabled } = await get(
-    `/api/lanes/${resolved.laneId}/integrations/${encodeURIComponent(name)}`
+    `/api/workspaces/${resolved.laneId}/integrations/${encodeURIComponent(name)}`
  );
  console.log(enabled ? "on" : "off");
  process.exitCode = enabled ? 0 : 1;
 }

-/** `agenthub lanes ci status <branch-or-sha> [<lane-id>]` — one-shot GitHub
+/** `agenthub workspace ci status <branch-or-sha> [<lane-id>]` — one-shot GitHub
 *  Actions status snapshot for a ref, via GET /:id/ci/status. Never polls;
 *  the caller (ship-feature-lane Stage 13) owns the wait loop. Exit code
 *  mirrors the derived state: 0 success, 1 failure or any error, 3 pending. */
@@ -2576,7 +2576,7 @@ async function cmdLanesCi(args) {
  const resolved = await resolveLaneArg(args.slice(2));
  if (!resolved) return;
  const result = await get(
-    `/api/lanes/${resolved.laneId}/ci/status?ref=${encodeURIComponent(ref)}`,
+    `/api/workspaces/${resolved.laneId}/ci/status?ref=${encodeURIComponent(ref)}`,
    undefined,
    { allowError: true }
  );
@@ -2590,7 +2590,7 @@ async function cmdLanesCi(args) {
 }

 /**
- * `agenthub lanes node [<node-id>] [extra…] [<id>] [--print]` — run ONE node of the
+ * `agenthub workspace node [<node-id>] [extra…] [<id>] [--print]` — run ONE node of the
 * lane's pipeline instead of the whole thing.
 *
 * Every node already carries the one command that drives it (`command`, added
@@ -2599,7 +2599,7 @@ async function cmdLanesCi(args) {
 * pasted it into a session by hand. This runs it, in the lane's own cwd:
 *
 *   - a slash command starts `claude` with it as the prompt;
- *   - anything else (`npm test`, `agenthub lanes hook ci-gate`) is spawned directly.
+ *   - anything else (`npm test`, `agenthub workspace hook ci-gate`) is spawned directly.
 *
 * With no node id it lists the nodes and their commands, which is also the
 * error path's answer. `--print` shows the argv and runs nothing.
@@ -2621,10 +2621,10 @@ async function cmdLanesNode(args) {
  const { flags, positional } = parseArgs(args);
  const resolved = await resolveLaneArg(args);
  if (!resolved) return;
-  const { lane } = await get(`/api/lanes/${resolved.laneId}`);
+  const { lane } = await get(`/api/workspaces/${resolved.laneId}`);
  // The lane payload's `pipeline_nodes` carries render state but not `aliases`;
  // the template does. Merge, so the listing can still mark the current node.
-  const { pipelines } = await get("/api/lanes/pipelines");
+  const { pipelines } = await get("/api/workspaces/pipelines");
  const stateOf = new Map((lane.pipeline_nodes || []).map((n) => [n.id, n.state]));
  const nodes = (pipelines.find((p) => p.id === lane.pipeline)?.nodes || []).map((n) => ({
    ...n,
@@ -2699,8 +2699,8 @@ async function cmdLanesNode(args) {
 }

 /**
- * `agenthub lanes pipeline [<template-id>] [<id>]` — show or switch which pipeline
- * template a lane renders against. `agenthub lanes add --pipeline` could only set
+ * `agenthub workspace pipeline [<template-id>] [<id>]` — show or switch which pipeline
+ * template a lane renders against. `agenthub workspace add --pipeline` could only set
 * this at creation time, so every lane added from the dashboard's "+ Add lane"
 * was stuck on `default` with no way back to a 16-node template.
 */
@@ -2710,15 +2710,15 @@ async function cmdLanesPipeline(args) {
  if (!resolved) return;

  if (!target) {
-    const { lane } = await get(`/api/lanes/${resolved.laneId}`);
-    const { pipelines } = await get("/api/lanes/pipelines");
+    const { lane } = await get(`/api/workspaces/${resolved.laneId}`);
+    const { pipelines } = await get("/api/workspaces/pipelines");
    console.log(`workspace #${lane.id} → ${lane.pipeline} (${lane.pipeline_nodes.length} nodes)`);
    if (lane.pipeline_skill) console.log(`driver: ${lane.pipeline_skill} <requirement>`);
    console.log(`available: ${pipelines.map((p) => `${p.id} (${p.nodes.length})`).join(", ")}`);
    return;
  }

-  const { lane } = await patch(`/api/lanes/${resolved.laneId}`, { pipeline: target });
+  const { lane } = await patch(`/api/workspaces/${resolved.laneId}`, { pipeline: target });
  console.log(
    `${c.green("✔")} workspace #${lane.id} → pipeline ${lane.pipeline} ` +
      `(${lane.pipeline_nodes.length} nodes, stage ${lane.stage}, ${lane.progress}%)`
@@ -2746,7 +2746,7 @@ async function cmdLanesPipeline(args) {
 async function cmdLanesShell(args) {
  const resolved = await resolveLaneArg(args);
  if (!resolved) return;
-  const { lane } = await get(`/api/lanes/${resolved.laneId}`);
+  const { lane } = await get(`/api/workspaces/${resolved.laneId}`);
  const sessionName = `agenthub-lane-${lane.id}`;
  const child = spawn("tmux", ["new-session", "-A", "-s", sessionName, "-c", lane.cwd], {
    stdio: "inherit",
@@ -2771,7 +2771,7 @@ async function cmdFeatureShow(args) {
  const resolved = await resolveLaneArg(args.filter((a) => a !== slug));
  if (!resolved) return;
  const result = await get(
-    `/api/lanes/${resolved.laneId}/features/${encodeURIComponent(slug)}`,
+    `/api/workspaces/${resolved.laneId}/features/${encodeURIComponent(slug)}`,
    undefined,
    { allowError: true }
  );
@@ -2806,7 +2806,7 @@ async function cmdStage(args) {
  if (!resolved) return;
  const laneId = resolved.laneId;

-  const { lane } = await post(`/api/lanes/${laneId}/stage`, {
+  const { lane } = await post(`/api/workspaces/${laneId}/stage`, {
    stage,
    status: flag("status"),
    evidence: flag("evidence"),
@@ -3101,8 +3101,8 @@ falling back to http://127.0.0.1:4820.
 ${c.bold("Output:")} colors auto-enable on a TTY and turn off when piped.
 Disable with --no-color or NO_COLOR=1; force with FORCE_COLOR=1 / AGENTHUB_COLOR=1.

-${c.bold("Old name:")} ${c.bold("agenthub lanes …")} and ${c.bold("--lane")} still work — the same
-commands as ${c.bold("agenthub workspace …")} and ${c.bold("--workspace")}.
+${c.bold("Old name:")} ${c.bold("agenthub lanes …")} and ${c.bold("--lane")} were removed — use
+${c.bold("agenthub workspace …")} and ${c.bold("--workspace")}.

 ${c.bold("Note:")} agenthub talks to the local dashboard server — API-backed commands
 require it to be running (${c.bold("agenthub start")} brings one up in the background).
@@ -3512,8 +3512,8 @@ function replHelp() {
 /** Detailed help for one command (or command prefix): every catalog entry
 *  whose invocation starts with the token. Returns false if none matched. */
 function commandHelp(token) {
-  // `lanes`, `workspace` and `workspaces` are one command (COMMAND_ALIASES),
-  // so `help lanes` finds the `workspace …` rows and vice versa.
+  // `workspace` and `workspaces` are one command (COMMAND_ALIASES), so
+  // `help workspaces` finds the `workspace …` rows and vice versa.
  const canon = (words) => {
    const [head, ...tail] = words.split(" ");
    return [COMMAND_ALIASES[head] || head, ...tail].join(" ");
@@ -3774,23 +3774,22 @@ async function cmdRepl() {
 // prompt. Handlers that need the server throw ServerDownError; the caller
 // decides whether to fall back to an offline reader or report the refusal.

-/** Command names that are another command under the user-facing word.
- *  `workspace` is the name to use; `lanes` (the handler's own name) and
- *  `--lane` are the OLD names, still working but deprecated. Removing them is
- *  step 4 of docs/plans/workspace-rename/README.md — not before the third
- *  release after the first one that shipped these aliases. */
-const COMMAND_ALIASES = { workspace: "lanes", workspaces: "lanes" };
+/** Command names that are another command under the user-facing word. */
+const COMMAND_ALIASES = { workspaces: "workspace" };
 const canonicalArgv = (argv) =>
  COMMAND_ALIASES[argv[0]] ? [COMMAND_ALIASES[argv[0]], ...argv.slice(1)] : argv;

-/** One stderr line when an old name is typed, so people and agents move over
- *  before step 4 removes it. stderr only: scripts reading stdout see nothing. */
-function warnOldNames(argv) {
-  const old = [];
-  if (argv[0] === "lanes") old.push("`agenthub lanes` → `agenthub workspace`");
-  if (argv.includes("--lane")) old.push("`--lane` → `--workspace`");
-  if (old.length) {
-    console.error(c.dim(`note: old name, still works for now — use ${old.join(", ")}`));
+/** The old names `agenthub workspace` and `--lane` were removed in step 4 of
+ *  docs/plans/workspace-rename/README.md. They exit 1 naming the new spelling
+ *  — never "Unknown command" or help, so a script written before says why. */
+function refuseOldNames(argv) {
+  if (argv[0] === "lanes") {
+    console.error(c.red("✖ renamed: use agenthub workspace …"));
+    process.exit(1);
+  }
+  if (argv.includes("--lane")) {
+    console.error(c.red("✖ renamed: use --workspace <id>"));
+    process.exit(1);
  }
 }

@@ -3803,7 +3802,6 @@ const COMMANDS = (() => {
    for (const [name] of items) set.add(name.split(" ")[0]);
  }
  set.add("help");
-  // The old names stay typeable (and completable) for scripts written before.
  for (const [alias, canonical] of Object.entries(COMMAND_ALIASES)) set.add(alias).add(canonical);
  return [...set];
 })();
@@ -4498,7 +4496,7 @@ async function cmdAccounts(sub, positional, flags = {}) {
 *  for usage/validation failures. `cmd === "repl"` is handled by the entry
 *  points, not here, to avoid recursive REPLs. */
 async function runCommand(argv) {
-  warnOldNames(argv);
+  refuseOldNames(argv);
  const [cmd, ...rest] = canonicalArgv(argv);
  const { flags, positional } = parseArgs(rest);
  switch (cmd) {
@@ -4571,7 +4569,7 @@ async function runCommand(argv) {
      return cmdReinstallHooks();
    case "update-check":
      return cmdUpdateCheck();
-    case "lanes":
+    case "workspace":
      if (rest[0] === "add") {
        return cmdLanesAdd(rest.slice(1));
      }
@@ -49,8 +49,8 @@ Enterprise-grade React + TypeScript dashboard for real-time Claude Code agent mo

 The client is a single-page application (SPA) built with modern web technologies:

- **React 18.3** - Component-based UI with hooks and concurrent features
- **TypeScript 5.7** - Full type safety across components, utilities, and API contracts
+- **React 19** - Component-based UI with hooks and concurrent features
+- **TypeScript 7** - Full type safety across components, utilities, and API contracts
 - **Vite 6.1** - Lightning-fast HMR during development, optimized production builds
 - **Tailwind CSS 3.4** - Utility-first CSS framework; colors are CSS-variable-backed tokens (`darkMode: "class"`) so a Dark/Light/System switch (Settings → Appearance; `useTheme` hook — the sidebar has no theme or language controls, the language lives in Settings → Appearance) re-themes the whole app by flipping one class. A **named theme** per mode is one more attribute: `data-theme` on `<html>` (absent for `default`) selects a CSS-variable block in `index.css` — `.dark[data-theme="darcula|apple-dark|orca-dark"]` and `[data-mode="light"][data-theme="apple-light|intellij-light|canvas|orca-light"]` — that overrides only the tokens it changes. `--tint-base` is `var(--surface-3)` and light `--syn-plain` is `var(--fg-primary)`, so a theme never restates them. A new theme is a block there plus an id in `THEMES` (`hooks/useTheme.ts`) and a label in `components/settings/AppearanceSettings.tsx`; its Settings preview needs no hex, because the swatch re-scopes the same variables on its own element. Storage: `theme` = `dark|light|system`, `agenthub.theme.dark` / `agenthub.theme.light` = theme ids (unknown ⇒ `default`); state is read through `useSyncExternalStore`, never cached in the module, so every consumer and every tab agree. An inline `<script>` at the top of `client/index.html` applies the same keys before first paint (no flash of the stock dark palette); it does not validate ids — the hook does, on mount. The workspace terminal's font is the same kind of preference: `agenthub.terminal.font` = `jetbrains|maple|system` (`lib/terminalFont.ts`, default `jetbrains`) and `agenthub.terminal.fontSize` = 11|12|13|14|15|16|18|20 px (`lib/fontSize.ts`, default 13), picked in Settings → Appearance; a change fires `agenthub-font-size` on `window`, so an open terminal re-fits at once. Settings → Appearance → **Text size** (`#text-size`) sets `agenthub.ui.fontSize` = 14|16|17|18 (Small/Default/Large/Larger), the ROOT font size in px (`lib/fontSize.ts`; the index.html script applies it before first paint too); Tailwind's sizes are rem and `index.css` re-states every `text-[Npx]` class in rem, so all text scales with it. All of these keys are synced to the account like the theme (`PREF_KEYS` in `lib/userPrefs.ts` and `server/routes/me.js`)

@@ -1215,7 +1215,7 @@ graph TB

 The client is a production-ready React application with:

- 🚀 **Modern Stack** - React 18, TypeScript, Vite, Tailwind
+- 🚀 **Modern Stack** - React 19, TypeScript, Vite, Tailwind
 - ⚡ **Real-time** - WebSocket integration for live updates
 - 🧪 **Tested** - Vitest + React Testing Library
 - 📦 **Optimized** - Code splitting, tree shaking, lazy loading
@@ -15,18 +15,18 @@
        "@fontsource/inter": "^5.2.8",
        "@fontsource/jetbrains-mono": "^5.2.8",
        "@fontsource/maple-mono": "^5.3.0",
-        "@xterm/addon-canvas": "^0.7.0",
-        "@xterm/addon-clipboard": "^0.1.0",
-        "@xterm/addon-fit": "^0.10.0",
-        "@xterm/addon-search": "^0.15.0",
-        "@xterm/addon-web-links": "^0.11.0",
-        "@xterm/xterm": "^5.5.0",
+        "@xterm/addon-clipboard": "^0.2.0",
+        "@xterm/addon-fit": "^0.11.0",
+        "@xterm/addon-search": "^0.16.0",
+        "@xterm/addon-web-links": "^0.12.0",
+        "@xterm/addon-webgl": "^0.19.0",
+        "@xterm/xterm": "^6.0.0",
        "d3": "^7.9.0",
        "i18next": "^26.0.8",
        "i18next-browser-languagedetector": "^8.2.1",
-        "lucide-react": "^0.474.0",
-        "react": "^18.3.1",
-        "react-dom": "^18.3.1",
+        "lucide-react": "^1.61.0",
+        "react": "^19.3.1",
+        "react-dom": "^19.3.1",
        "react-i18next": "^17.0.4",
        "react-markdown": "^10.1.0",
        "react-router-dom": "^7.18.4",
@@ -34,17 +34,17 @@
      },
      "devDependencies": {
        "@testing-library/jest-dom": "^6.9.1",
-        "@testing-library/react": "^16.3.2",
+        "@testing-library/react": "^16.3.3",
        "@testing-library/user-event": "^14.6.1",
        "@types/d3": "^7.4.3",
-        "@types/react": "^18.3.18",
-        "@types/react-dom": "^18.3.5",
+        "@types/react": "^19.3.0",
+        "@types/react-dom": "^19.3.0",
        "@vitejs/plugin-react": "^4.3.4",
        "autoprefixer": "^10.4.20",
        "jsdom": "^27.0.1",
        "postcss": "^8.5.1",
        "tailwindcss": "^3.4.17",
-        "typescript": "^5.7.3",
+        "typescript": "^7.0.2",
        "vite": "^6.1.0",
        "vitest": "^3.2.4"
      }
@@ -450,10 +450,9 @@
      }
    },
    "node_modules/@codemirror/merge": {
-      "version": "6.12.2",
-      "resolved": "https://registry.npmjs.org/@codemirror/merge/-/merge-6.12.2.tgz",
-      "integrity": "sha512-V8JvyAPjHbPupqP7BeMcsdsYCbyPij74jxIbaIJDORI+VZzW44zFmon8bF+oxGWvOKhcRmkiUMXd8MxHr3YA2w==",
-      "license": "MIT",
+      "version": "6.12.3",
+      "resolved": "https://registry.npmjs.org/@codemirror/merge/-/merge-6.12.3.tgz",
+      "integrity": "sha512-Wq9wXrp41cW/nIpi1CQPyNwD+36kg8KIX676ym0Hyfn3Dpr+XQHNAIsZYVNlaivuVB4SAASbreG3V0VXinbqZA==",
      "dependencies": {
        "@codemirror/language": "^6.0.0",
        "@codemirror/state": "^6.0.0",
@@ -478,10 +477,9 @@
      "license": "MIT"
    },
    "node_modules/@codemirror/view": {
-      "version": "6.43.14",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.14.tgz",
-      "integrity": "sha512-hC45YnmJNR1rz42OF57BLoQNFMV12/13drnvibDsR2quNDmldcb4WvYVV81hFQg56i9lcqQMEDqilhX2QDcGQQ==",
-      "license": "MIT",
+      "version": "6.43.15",
+      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.15.tgz",
+      "integrity": "sha512-HHsfpqFeHyXLs983pSRe38Xajs0vFWZQ2BuX0m7Ki8w3jZ5iD8cuR3lBz2/5/X53Dhf32SBHKh6rtSTB6tKeGw==",
      "dependencies": {
        "@codemirror/state": "^6.7.0",
        "crelt": "^1.0.6",
@@ -1661,7 +1659,6 @@
      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.3.tgz",
      "integrity": "sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg==",
      "dev": true,
-      "license": "MIT",
      "dependencies": {
        "@babel/runtime": "^7.12.5"
      },
@@ -2108,30 +2105,21 @@
      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
      "license": "MIT"
    },
-    "node_modules/@types/prop-types": {
-      "version": "15.7.15",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
-      "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==",
-      "license": "MIT"
-    },
    "node_modules/@types/react": {
-      "version": "18.3.31",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.31.tgz",
-      "integrity": "sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==",
-      "license": "MIT",
+      "version": "19.3.0",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz",
+      "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==",
      "dependencies": {
-        "@types/prop-types": "*",
        "csstype": "^3.2.2"
      }
    },
    "node_modules/@types/react-dom": {
-      "version": "18.3.7",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz",
-      "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
+      "version": "19.3.0",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz",
+      "integrity": "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==",
      "dev": true,
-      "license": "MIT",
      "peerDependencies": {
-        "@types/react": "^18.0.0"
+        "@types/react": "^19.3.0"
      }
    },
    "node_modules/@types/unist": {
@@ -2140,6 +2128,326 @@
      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
      "license": "MIT"
    },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
    "node_modules/@ungap/structured-clone": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
@@ -2282,59 +2590,38 @@
        "url": "https://opencollective.com/vitest"
      }
    },
-    "node_modules/@xterm/addon-canvas": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-canvas/-/addon-canvas-0.7.0.tgz",
-      "integrity": "sha512-LF5LYcfvefJuJ7QotNRdRSPc9YASAVDeoT5uyXS/nZshZXjYplGXRECBGiznwvhNL2I8bq1Lf5MzRwstsYQ2Iw==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@xterm/xterm": "^5.0.0"
-      }
-    },
    "node_modules/@xterm/addon-clipboard": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-clipboard/-/addon-clipboard-0.1.0.tgz",
-      "integrity": "sha512-zdoM7p53T5sv/HbRTyp4hY0kKmEQ3MZvAvEtiXqNIHc/JdpqwByCtsTaQF5DX2n4hYdXRPO4P/eOS0QEhX1nPw==",
-      "license": "MIT",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-clipboard/-/addon-clipboard-0.2.0.tgz",
+      "integrity": "sha512-Dl31BCtBhLaUEECUbEiVcCLvLBbaeGYdT7NofB8OJkGTD3MWgBsaLjXvfGAD4tQNHhm6mbKyYkR7XD8kiZsdNg==",
      "dependencies": {
        "js-base64": "^3.7.5"
-      },
-      "peerDependencies": {
-        "@xterm/xterm": "^5.4.0"
      }
    },
    "node_modules/@xterm/addon-fit": {
-      "version": "0.10.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.10.0.tgz",
-      "integrity": "sha512-UFYkDm4HUahf2lnEyHvio51TNGiLK66mqP2JoATy7hRZeXaGMRDr00JiSF7m63vR5WKATF605yEggJKsw0JpMQ==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@xterm/xterm": "^5.0.0"
-      }
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.11.0.tgz",
+      "integrity": "sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g=="
    },
    "node_modules/@xterm/addon-search": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-search/-/addon-search-0.15.0.tgz",
-      "integrity": "sha512-ZBZKLQ+EuKE83CqCmSSz5y1tx+aNOCUaA7dm6emgOX+8J9H1FWXZyrKfzjwzV+V14TV3xToz1goIeRhXBS5qjg==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@xterm/xterm": "^5.0.0"
-      }
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-search/-/addon-search-0.16.0.tgz",
+      "integrity": "sha512-9OeuBFu0/uZJPu+9AHKY6g/w0Czyb/Ut0A5t79I4ULoU4IfU5BEpPFVGQxP4zTTMdfZEYkVIRYbHBX1xWwjeSA=="
    },
    "node_modules/@xterm/addon-web-links": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@xterm/addon-web-links/-/addon-web-links-0.11.0.tgz",
-      "integrity": "sha512-nIHQ38pQI+a5kXnRaTgwqSHnX7KE6+4SVoceompgHL26unAxdfP6IPqUTSYPQgSwM56hsElfoNrrW5V7BUED/Q==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@xterm/xterm": "^5.0.0"
-      }
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-web-links/-/addon-web-links-0.12.0.tgz",
+      "integrity": "sha512-4Smom3RPyVp7ZMYOYDoC/9eGJJJqYhnPLGGqJ6wOBfB8VxPViJNSKdgRYb8NpaM6YSelEKbA2SStD7lGyqaobw=="
+    },
+    "node_modules/@xterm/addon-webgl": {
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@xterm/addon-webgl/-/addon-webgl-0.19.0.tgz",
+      "integrity": "sha512-b3fMOsyLVuCeNJWxolACEUED0vm7qC0cy4wRvf3oURSzDTYVQiGPhTnhWZwIHdvC48Y+oLhvYXnY4XDXPoJo6A=="
    },
    "node_modules/@xterm/xterm": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-5.5.0.tgz",
-      "integrity": "sha512-hqJHYaQb5OptNunnyAnkHyM8aCjZ1MEIDTQu1iIbbTD/xops91NB5yq1ZK/dC2JDbVWtF23zUtl9JE2NqwT87A==",
-      "license": "MIT"
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz",
+      "integrity": "sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg=="
    },
    "node_modules/agent-base": {
      "version": "7.1.4",
@@ -3706,9 +3993,9 @@
      }
    },
    "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "version": "26.5.11",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.5.11.tgz",
+      "integrity": "sha512-Wc0klBPKxqZ2tL2qdAnF8xvvnWgr1IMGSY2ikTiAvaFVbz7xiFARtkoU4RidBDw1SyziGROp0qxu6qnJ7l2Wug==",
      "funding": [
        {
          "type": "individual",
@@ -3723,7 +4010,6 @@
          "url": "https://www.locize.com"
        }
      ],
-      "license": "MIT",
      "peerDependencies": {
        "typescript": "^5 || ^6 || ^7"
      },
@@ -3734,12 +4020,11 @@
      }
    },
    "node_modules/i18next-browser-languagedetector": {
-      "version": "8.2.1",
-      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-8.2.1.tgz",
-      "integrity": "sha512-bZg8+4bdmaOiApD7N7BPT9W8MLZG+nPTOFlLiJiT8uzKXFjhxw4v2ierCXOwB5sFDMtuA5G4kgYZ0AznZxQ/cw==",
-      "license": "MIT",
+      "version": "8.2.3",
+      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-8.2.3.tgz",
+      "integrity": "sha512-0jSTK3ncpXj9MFdxRz+TVTKDkSvYH8ifB/OCmUdEMprvXC3vy7kEvdKpj0yYB72B0UKEHJLPMEeRVC/UXroWnw==",
      "dependencies": {
-        "@babel/runtime": "^7.23.2"
+        "@babel/runtime": "^7.29.2"
      }
    },
    "node_modules/iconv-lite": {
@@ -3924,6 +4209,7 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/jsdom": {
@@ -4022,18 +4308,6 @@
        "url": "https://github.com/sponsors/wooorm"
      }
    },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "license": "MIT",
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
    "node_modules/loupe": {
      "version": "3.2.1",
      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz",
@@ -4052,12 +4326,17 @@
      }
    },
    "node_modules/lucide-react": {
-      "version": "0.474.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.474.0.tgz",
-      "integrity": "sha512-CmghgHkh0OJNmxGKWc0qfPJCYHASPMVSyGY8fj3xgk4v84ItqDg64JNKFZn5hC6E0vHi6gxnbCgwhyVB09wQtA==",
-      "license": "ISC",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.61.0.tgz",
+      "integrity": "sha512-v2SQPPPNjnr+BlhL9Spuzmo5yR+hLkftfuE4E3jaxdNPgSH0hJKPcLJBP7yAta87jQNPsSERS59PJjCJ/CorBA==",
      "peerDependencies": {
+        "@types/react": "*",
        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
      }
    },
    "node_modules/lz-string": {
@@ -5378,35 +5657,28 @@
      "license": "MIT"
    },
    "node_modules/react": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
-      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      },
+      "version": "19.3.1",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.3.1.tgz",
+      "integrity": "sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==",
      "engines": {
        "node": ">=0.10.0"
      }
    },
    "node_modules/react-dom": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
-      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
-      "license": "MIT",
+      "version": "19.3.1",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.3.1.tgz",
+      "integrity": "sha512-Y0bARz53lhEC1NMCASs0/j+faB/zqt3R8hpvg1e8+61ZVJ4UL0UdC4cBbXfZMcIuhrfgeILTLe+ZeBCavQPtKQ==",
      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.2"
+        "scheduler": "^0.28.0"
      },
      "peerDependencies": {
-        "react": "^18.3.1"
+        "react": "^19.3.1"
      }
    },
    "node_modules/react-i18next": {
-      "version": "17.0.16",
-      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.16.tgz",
-      "integrity": "sha512-7uImVD9hG5yUOaP5KHVied1x0A004Di/KU031ULR35Ma+9e9H5GdnNZHgQEIByyAz+IAXBkRDTedNVzjPUH8ZA==",
-      "license": "MIT",
+      "version": "17.1.9",
+      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.1.9.tgz",
+      "integrity": "sha512-OgYqIH13XHPlWTaaI795Dz+k2AdKnXcOxNQVnf750T8Ij0TYWp1nYvXRpoJBulPqlyk2OAbn1PM4tFKiIj/byA==",
      "dependencies": {
        "@babel/runtime": "^7.29.7",
        "html-parse-stringify": "^4.0.1",
@@ -5755,13 +6027,9 @@
      }
    },
    "node_modules/scheduler": {
-      "version": "0.23.2",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
-      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      }
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz",
+      "integrity": "sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw=="
    },
    "node_modules/semver": {
      "version": "6.3.1",
@@ -5774,9 +6042,9 @@
      }
    },
    "node_modules/set-cookie-parser": {
-      "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
-      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw=="
+      "version": "2.7.3",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.3.tgz",
+      "integrity": "sha512-irZHtTqurLna57KQG/s+fzOwv/J6XSH4cs8M/vsrY3uCaQ3S6+QJguAH0WdN47SXlk82voMZ4naWMQf8fdEoIg=="
    },
    "node_modules/siginfo": {
      "version": "2.0.0",
@@ -6183,17 +6451,37 @@
      "license": "Apache-2.0"
    },
    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
      "devOptional": true,
-      "license": "Apache-2.0",
      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
+        "tsc": "bin/tsc"
      },
      "engines": {
-        "node": ">=14.17"
+        "node": ">=16.20.0"
+      },
+      "optionalDependencies": {
+        "@typescript/typescript-aix-ppc64": "7.0.2",
+        "@typescript/typescript-darwin-arm64": "7.0.2",
+        "@typescript/typescript-darwin-x64": "7.0.2",
+        "@typescript/typescript-freebsd-arm64": "7.0.2",
+        "@typescript/typescript-freebsd-x64": "7.0.2",
+        "@typescript/typescript-linux-arm": "7.0.2",
+        "@typescript/typescript-linux-arm64": "7.0.2",
+        "@typescript/typescript-linux-loong64": "7.0.2",
+        "@typescript/typescript-linux-mips64el": "7.0.2",
+        "@typescript/typescript-linux-ppc64": "7.0.2",
+        "@typescript/typescript-linux-riscv64": "7.0.2",
+        "@typescript/typescript-linux-s390x": "7.0.2",
+        "@typescript/typescript-linux-x64": "7.0.2",
+        "@typescript/typescript-netbsd-arm64": "7.0.2",
+        "@typescript/typescript-netbsd-x64": "7.0.2",
+        "@typescript/typescript-openbsd-arm64": "7.0.2",
+        "@typescript/typescript-openbsd-x64": "7.0.2",
+        "@typescript/typescript-sunos-x64": "7.0.2",
+        "@typescript/typescript-win32-arm64": "7.0.2",
+        "@typescript/typescript-win32-x64": "7.0.2"
      }
    },
    "node_modules/unified": {
@@ -18,18 +18,18 @@
    "@fontsource/inter": "^5.2.8",
    "@fontsource/jetbrains-mono": "^5.2.8",
    "@fontsource/maple-mono": "^5.3.0",
-    "@xterm/addon-canvas": "^0.7.0",
-    "@xterm/addon-clipboard": "^0.1.0",
-    "@xterm/addon-fit": "^0.10.0",
-    "@xterm/addon-search": "^0.15.0",
-    "@xterm/addon-web-links": "^0.11.0",
-    "@xterm/xterm": "^5.5.0",
+    "@xterm/addon-clipboard": "^0.2.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-search": "^0.16.0",
+    "@xterm/addon-web-links": "^0.12.0",
+    "@xterm/addon-webgl": "^0.19.0",
+    "@xterm/xterm": "^6.0.0",
    "d3": "^7.9.0",
    "i18next": "^26.0.8",
    "i18next-browser-languagedetector": "^8.2.1",
-    "lucide-react": "^0.474.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "lucide-react": "^1.61.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
    "react-i18next": "^17.0.4",
    "react-markdown": "^10.1.0",
    "react-router-dom": "^7.18.4",
@@ -37,17 +37,17 @@
  },
  "devDependencies": {
    "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
+    "@testing-library/react": "^16.3.3",
    "@testing-library/user-event": "^14.6.1",
    "@types/d3": "^7.4.3",
-    "@types/react": "^18.3.18",
-    "@types/react-dom": "^18.3.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
    "@vitejs/plugin-react": "^4.3.4",
    "autoprefixer": "^10.4.20",
    "jsdom": "^27.0.1",
    "postcss": "^8.5.1",
    "tailwindcss": "^3.4.17",
-    "typescript": "^5.7.3",
+    "typescript": "^7.0.2",
    "vite": "^6.1.0",
    "vitest": "^3.2.4"
  }
@@ -49,7 +49,7 @@
    <g transform="translate(20,22)"><rect width="48" height="48" rx="12" fill="#4cc3f5" fill-opacity="0.12"/><rect x="11" y="11" width="11" height="11" rx="3" fill="#4cc3f5"/><rect x="26" y="11" width="11" height="11" rx="3" fill="none" stroke="#4cc3f5" stroke-width="2.5"/><rect x="11" y="26" width="11" height="11" rx="3" fill="none" stroke="#4cc3f5" stroke-width="2.5"/><rect x="26" y="26" width="11" height="11" rx="3" fill="#4cc3f5"/></g>
    <text x="84" y="44" font-family="'Inter', 'Segoe UI', 'Helvetica Neue', Arial, sans-serif" font-size="21" font-weight="700" fill="#f1f5ff">Every AI coding agent</text>
    <text x="84" y="72" font-family="'Inter', 'Segoe UI', 'Helvetica Neue', Arial, sans-serif" font-size="16" fill="#9aa6c4">Claude Code, Codex, Antigravity,</text>
-    <text x="84" y="94" font-family="'Inter', 'Segoe UI', 'Helvetica Neue', Arial, sans-serif" font-size="16" fill="#9aa6c4">Cursor, Kimi, Grok and more</text>
+    <text x="84" y="94" font-family="'Inter', 'Segoe UI', 'Helvetica Neue', Arial, sans-serif" font-size="16" fill="#9aa6c4">Cursor, omp and more</text>
  </g>
  <g transform="translate(792,300)">
    <rect width="344" height="116" rx="16" fill="#ffffff" fill-opacity="0.045" stroke="#ffffff" stroke-opacity="0.10"/>
@@ -24,10 +24,18 @@ export function DocumentTitle() {
    title = `${t("sessions")} · ${sessionId.slice(0, 8)}`;
  } else if (path.startsWith("/sessions")) {
    title = t("sessions");
+  } else if (path.startsWith("/snapshot/")) {
+    title = t("snapshot");
  } else if (path.startsWith("/workspace")) {
    title = t("workspace");
  } else if (path.startsWith("/settings")) {
    title = t("settings");
+  } else if (path.startsWith("/artifacts")) {
+    title = t("artifacts");
+  } else if (path.startsWith("/files")) {
+    title = t("files");
+  } else if (path.startsWith("/admin")) {
+    title = t("admin");
  } else if (path !== "/") {
    title = t("notFound");
  }
@@ -93,7 +93,7 @@ export const SagiAvatar = memo(function SagiAvatar({
  moment = null,
 }: SagiAvatarProps) {
  const rootRef = useRef<SVGSVGElement | null>(null);
-  const rafRef = useRef<number>();
+  const rafRef = useRef<number | undefined>(undefined);

  // Pupils follow the cursor whenever motion is allowed and the eyes are open.
  // (Only `sleeping` closes them by intent; `disconnected` hides the open-eye
@@ -197,11 +197,11 @@ export function useSagiBrain(): SagiBrain {
  const [bubble, setBubbleState] = useState<SagiBubble | null>(null);
  const [moment, setMoment] = useState<SagiBrain["moment"]>(null);
  const [reaction, setReaction] = useState<SagiBrain["reaction"]>(null);
-  const reactionTimer = useRef<ReturnType<typeof setTimeout>>();
+  const reactionTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
  const [muted, setMuted] = useState<boolean>(() => sagiPrefs.getMuted());

-  const bubbleTimer = useRef<ReturnType<typeof setTimeout>>();
-  const momentTimer = useRef<ReturnType<typeof setTimeout>>();
+  const bubbleTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
+  const momentTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
  const lastBubbleAt = useRef(0);
  const burst = useRef<Burst | null>(null);
  const momentKey = useRef(0);
@@ -5,7 +5,8 @@
 * — with a green dot while a newer release is out —, how many SESSIONS are
 * running and how many need the user (`GET /api/sessions?status=active` and
 * `?awaiting=1` — the Dashboard's Needs-you rule —, re-read on session
- * messages), and today's spend — `GET /api/pricing/cost?date=<local date>` — and, on the
+ * messages), and today's spend — `GET /api/pricing/cost?date=<local date>&mine=1`, the
+ * user's OWN spend even for an admin — and, on the
 * Workspace page, the open workspace's total (`?lane=` on the same call: the
 * sessions it owns) and the shown session's (`GET /api/pricing/cost/:id` for
 * the URL's `session`, or the focused pane's session from the page's run poll,
@@ -50,9 +51,6 @@ const QUOTA_TOOL_LABEL: Record<ToolQuota["id"], string> = {
  codex: "Codex",
  antigravity: "Antigravity",
  cursor: "Cursor",
-  grok: "Grok",
-  kimi: "Kimi",
-  opencode: "OpenCode Go",
 };

 function localDate(d = new Date()): string {
@@ -281,7 +279,7 @@ function QuotaChips() {
  const [open, setOpen] = useState(false);
  // Leaving the chips closes the panel only after a beat, and entering the
  // panel cancels that: the pointer crosses the gap to read it.
-  const closeTimer = useRef<number>();
+  const closeTimer = useRef<number | undefined>(undefined);
  const show = () => {
    window.clearTimeout(closeTimer.current);
    setOpen(true);
@@ -406,7 +404,7 @@ export function StatusBar({
    const gen = costGen.current;
    const live = () => gen === costGen.current;
    api.pricing
-      .totalCost({ date: localDate() })
+      .totalCost({ date: localDate(), mine: true })
      .then((r) => live() && setToday(r))
      .catch(() => undefined);
    api.budgets
@@ -260,9 +260,8 @@ export function UpdateNotifier() {
  // poll that reloads the page keep running, and a failure re-opens it.
  const closeForNow = useCallback(() => {
    if (!dismissKey) return;
-    if (applying || restarting) toast.info(t("backgroundNote"));
    setClosedKey(dismissKey);
-  }, [applying, restarting, dismissKey, t]);
+  }, [dismissKey]);

  const dismiss = useCallback(() => {
    if (busy || !dismissKey) return;
@@ -13,7 +13,7 @@ import { AgentCard } from "../AgentCard";
 import type { Agent } from "../../lib/types";
 import { formatModelName, fmtCost } from "../../lib/format";

-function renderCard(element: JSX.Element) {
+function renderCard(element: React.JSX.Element) {
  return render(<MemoryRouter>{element}</MemoryRouter>);
 }

@@ -34,5 +34,13 @@ describe("DocumentTitle", () => {
    expect(titleFor("/")).toMatch(/^Dashboard · /);
    expect(titleFor("/sessions")).toMatch(/^Sessions · /);
    expect(titleFor("/settings")).toMatch(/^Settings · /);
+    expect(titleFor("/artifacts")).toMatch(/^Artifacts · /);
+    expect(titleFor("/files")).toMatch(/^Files · /);
+    expect(titleFor("/admin")).toMatch(/^Administration · /);
+    expect(titleFor("/snapshot/abc")).toMatch(/^Snapshot · /);
+  });
+
+  it("titles an unknown route as not found", () => {
+    expect(titleFor("/nope")).toMatch(/^Not found · /);
  });
 });
@@ -151,7 +151,7 @@ import { api } from "../../lib/api";
 import { StatusBar } from "../StatusBar";
 import { LIVE_RUNS_EVENT } from "../WorkspaceTree";

-const at = (url: string, ui: JSX.Element) =>
+const at = (url: string, ui: React.JSX.Element) =>
  render(<MemoryRouter initialEntries={[url]}>{ui}</MemoryRouter>);

 describe("StatusBar", () => {
@@ -162,7 +162,7 @@ describe("StatusBar", () => {
    const conn = screen.getByRole("button", { name: /Live/ });
    expect(conn).toHaveTextContent(`v${__APP_VERSION__}`);
    const cost = await screen.findByText("Today $1.23 (12.3M Tokens)");
-    expect(api.pricing.totalCost).toHaveBeenCalledWith({ date: today() });
+    expect(api.pricing.totalCost).toHaveBeenCalledWith({ date: today(), mine: true });
    expect(cost).toHaveAttribute(
      "title",
      "Claude Opus 4.8: 12.0M · $1.20\nClaude Haiku 4.5: 300.0K · $0.03"
@@ -78,7 +78,12 @@ import { useSpin } from "../../hooks/useSpin";
 import { useOnScreen, isShown } from "../../hooks/useOnScreen";
 import { throttle } from "../../lib/throttle";
 import { useTranslation } from "react-i18next";
-import type { TranscriptMessage, TranscriptInfo, WSMessage } from "../../lib/types";
+import type {
+  TranscriptMessage,
+  TranscriptInfo,
+  TranscriptResult,
+  WSMessage,
+} from "../../lib/types";

 // Catch-up poll interval. Claude Code only fires hooks on PreToolUse /
 // PostToolUse / Stop, which means a user-typed message (no hook) and any
@@ -175,6 +180,8 @@ function ConversationViewPane({
    initialTranscriptId ?? null
  );
  const [hasMore, setHasMore] = useState(false);
+  // The edits of the turn the oldest loaded page starts inside of (`turn_edits`).
+  const [leadEdits, setLeadEdits] = useState<TranscriptResult["turn_edits"]>(undefined);
  const [error, setError] = useState<string | null>(null);
  const [transcripts, setTranscripts] = useState<TranscriptInfo[]>([]);
  const [showNewMsg, setShowNewMsg] = useState(false);
@@ -283,6 +290,7 @@ function ConversationViewPane({
        if (cancelled) return;
        setNotStarted(false);
        setMessages(result.messages);
+        setLeadEdits(result.turn_edits);
        setTotal(result.total);
        setHasMore(result.has_more);
        lastLineRef.current = result.last_line;
@@ -343,6 +351,7 @@ function ConversationViewPane({
        // Seed the view in a single render so the user sees the whole
        // catch-up batch instead of a blank panel followed by a partial one.
        setMessages(result.messages);
+        setLeadEdits(result.turn_edits);
        firstLineRef.current = result.first_line;
        setHasMore(result.has_more);
      } else {
@@ -487,6 +496,7 @@ function ConversationViewPane({
      firstLineRef.current = result.first_line;

      setMessages((prev) => [...result.messages, ...prev]);
+      setLeadEdits(result.turn_edits);
      setHasMore(result.has_more);

      // Preserve scroll position (don't jump to top)
@@ -686,6 +696,7 @@ function ConversationViewPane({
              stopped={stopped}
              agentLinks={agentLinks}
              compact={compact}
+              leadEdits={leadEdits}
              sessionId={
                selectedTranscript && selectedTranscript !== "main" ? undefined : sessionId
              }
@@ -172,6 +172,9 @@ interface MessageListProps {
  /** A subagent's conversation inside its step: tight spacing, and the task
   *  the orchestrator gave it reads as the prompt it is. */
  compact?: boolean;
+  /** The files the first, cut-off turn changed before `messages` begins (the
+   *  transcript page's `turn_edits`): counted in that turn's card. */
+  leadEdits?: TranscriptContent["edits"];
 }

 /** Build a map from tool_use id → tool_result for matching */
@@ -491,6 +494,10 @@ type Item =
  | { kind: "command"; key: string; name: string | null; output: string | null; error: boolean };

 const EDIT_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+// A subagent's result carries the files IT changed (`edits`): they count too.
+const AGENT_TOOLS = new Set(["Agent", "Task"]);
+// The stand-in for the part of a turn the page cut off: its `edits` count.
+const LEAD = "__lead_edits";

 /** A line that is only Claude Code's local-command plumbing — the caveat it
 *  writes first, the command, what the command printed — or null for
@@ -515,11 +522,18 @@ export function localCommand(
  return { name, output, error };
 }

-export function chatItems(messages: TranscriptMessage[], keys: string[]): Item[] {
+export function chatItems(
+  messages: TranscriptMessage[],
+  keys: string[],
+  leadEdits?: TranscriptContent["edits"]
+): Item[] {
  const items: Item[] = [];
  // The file-changing calls of the turn so far, closed into one card when the
-  // human speaks again (or the list ends).
-  let edits: TranscriptContent[] = [];
+  // human speaks again (or the list ends) — starting with what the page's
+  // cut-off first turn changed before it.
+  let edits: TranscriptContent[] = leadEdits?.length
+    ? [{ type: "tool_use", name: LEAD, edits: leadEdits }]
+    : [];
  // The turn's prompt time, its newest assistant line and its output so far,
  // for the "Done in …" line under a turn that ended.
  let start: string | null = null;
@@ -592,7 +606,11 @@ export function chatItems(messages: TranscriptMessage[], keys: string[]): Item[]
    if (msg.usage) output.add(msg.usage);
    msg.content.forEach((block, b) => {
      const last = items[items.length - 1];
-      if (block.type === "tool_use" && EDIT_TOOLS.has(block.name ?? "")) edits.push(block);
+      if (
+        block.type === "tool_use" &&
+        (EDIT_TOOLS.has(block.name ?? "") || AGENT_TOOLS.has(block.name ?? ""))
+      )
+        edits.push(block);
      // A question to the user is a turn of the conversation, not hidden work.
      if (block.type === "tool_use" && block.name === "AskUserQuestion") {
        items.push({ kind: "ask", key: `${key}:${b}`, block });
@@ -672,19 +690,38 @@ function EditedFilesCard({
  const files = new Map<string, { added: number; removed: number; counted: boolean }>();
  // Written whole in this turn (a Write): a component made here is an artifact.
  const created = new Set<string>();
+  // Changed only by a subagent: listed, never an artifact card — the chat
+  // rebuilds an artifact from this transcript's Write/Edit inputs, which a
+  // subagent's are not.
+  const byAgent = new Set<string>();
  for (const b of blocks) {
+    const r0 = b.id ? toolResultMap.get(b.id) : undefined;
+    if (AGENT_TOOLS.has(b.name ?? "") || b.name === LEAD) {
+      for (const e of (b.name === LEAD ? b.edits : r0?.edits) ?? []) {
+        if (!files.has(e.path)) byAgent.add(e.path);
+        const f = files.get(e.path) ?? { added: 0, removed: 0, counted: false };
+        f.added += e.added;
+        f.removed += e.removed;
+        f.counted ||= e.counted;
+        files.set(e.path, f);
+      }
+      continue;
+    }
    const input = (b.input ?? {}) as Record<string, unknown>;
    const p = input.file_path ?? input.notebook_path;
    const r = b.id ? toolResultMap.get(b.id) : undefined;
    if (typeof p !== "string" || !r || r.is_error) continue;
    if (b.name === "Write") created.add(p);
+    byAgent.delete(p);
    const f = files.get(p) ?? { added: 0, removed: 0, counted: false };
    f.added += r.diff?.added ?? 0;
    f.removed += r.diff?.removed ?? 0;
    f.counted ||= !!r.diff;
    files.set(p, f);
  }
-  const artifacts = [...files.keys()].filter((p) => isArtifact(p, created.has(p)));
+  const artifacts = [...files.keys()].filter(
+    (p) => !byAgent.has(p) && isArtifact(p, created.has(p))
+  );
  const cards = artifacts.length > 0 && (
    <div data-testid="artifact-cards" className="flex flex-col gap-2">
      {artifacts.map((p) => (
@@ -773,6 +810,7 @@ function MessageListView({
  sessionId,
  agentLinks,
  compact = false,
+  leadEdits,
 }: MessageListProps) {
  const { t } = useTranslation("sessions");
  const toolResultMap = useMemo(() => buildToolResultMap(messages), [messages]);
@@ -798,9 +836,10 @@ function MessageListView({
              m.sender === "orchestrator" ? { ...m, sender: "user" as const } : m
            )
          : messages,
-        keys
+        keys,
+        leadEdits
      ),
-    [messages, keys, compact]
+    [messages, keys, compact, leadEdits]
  );
  const agents = useMemo(
    () => (live ? backgroundAgents(messages, toolResultMap) : []),
@@ -4,7 +4,10 @@
 * Desktop's "Edited N files" card: one row per file with the lines added and
 * removed summed over the turn, a failed call left out, a row click handed
 * to the caller, and a row (or the header, every file) dragged as `@path`
- * attachments for a prompt box.
+ * attachments for a prompt box. Files a subagent changed (its Agent
+ * result's `edits`, read from its own transcript) are counted in the same
+ * card, never as an artifact; so are the files a turn changed before the
+ * loaded page began (`leadEdits`, the page's `turn_edits`).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import { describe, it, expect, vi } from "vitest";
@@ -127,4 +130,71 @@ describe("the Edited N files card", () => {
      JSON.parse(all["application/x-agenthub-attach"]!).map((a: { path: string }) => a.path)
    ).toEqual(["@/w/a.ts", "@/w/b.json"]);
  });
+
+  it("counts the files a subagent changed, beside the turn's own edits", () => {
+    render(
+      <MessageList
+        loading={false}
+        messages={[
+          user("run the task"),
+          call("1", "Edit", "/w/a.go"),
+          result("1", { added: 1, removed: 0 }),
+          {
+            type: "assistant",
+            sender: "assistant",
+            timestamp: at,
+            content: [{ type: "tool_use", id: "2", name: "Agent", input: { prompt: "do it" } }],
+          } as TranscriptMessage,
+          {
+            type: "user",
+            sender: "tool",
+            timestamp: at,
+            content: [
+              {
+                type: "tool_result",
+                id: "2",
+                output: "done",
+                agent: { id: "x1" },
+                edits: [
+                  { path: "/w/a.go", added: 4, removed: 2, counted: true },
+                  { path: "/w/b_test.go", added: 9, removed: 0, counted: true },
+                  { path: "/w/report.html", added: 5, removed: 0, counted: true },
+                ],
+              },
+            ],
+          } as TranscriptMessage,
+          user("thanks"),
+        ]}
+      />
+    );
+    const card = screen.getByTestId("edited-files");
+    expect(card.textContent).toContain("Edited 3 files");
+    expect(within(card).getByText("b_test.go")).toBeTruthy();
+    expect(within(card).getByTitle("/w/a.go").textContent).toContain("+5"); // a.go: 1 + 4
+    // A page only a subagent wrote is listed, not shown as an artifact card.
+    expect(within(card).getByText("report.html")).toBeTruthy();
+    expect(screen.queryByTestId("artifact-card")).toBeNull();
+  });
+
+  it("adds what the cut-off first turn changed before the page to that turn's card", () => {
+    render(
+      <MessageList
+        loading={false}
+        leadEdits={[{ path: "/w/rbac_test.go", added: 176, removed: 0, counted: true }]}
+        messages={[
+          call("1", "Write", "/w/handler_test.go"),
+          result("1", { added: 113, removed: 0 }),
+          user("what changed?"),
+          call("2", "Edit", "/w/x.go"),
+          result("2", { added: 1, removed: 0 }),
+        ]}
+      />
+    );
+    const [first, second] = screen.getAllByTestId("edited-files");
+    expect(first!.textContent).toContain("Edited 2 files");
+    expect(within(first!).getByText("rbac_test.go")).toBeTruthy();
+    expect(within(first!).getByText("handler_test.go")).toBeTruthy();
+    // The next turn's card is its own.
+    expect(second!.textContent).toContain("Edited 1 file");
+  });
 });
@@ -69,7 +69,7 @@ const TOOLS: AiToolsView = {
    tool("codex", "Codex", { launcher: "codex", proxyCapable: true, prompt: null }),
    tool("gemini", "Gemini"),
    tool("aider", "Aider", { installed: false, path: null }),
-    tool("grok", "Grok", { enabled: false }),
+    tool("goose", "Goose", { enabled: false }),
  ],
 };

@@ -382,7 +382,8 @@ describe("LaneChangesPanel", () => {
    const box = within(folder.parentElement!).getByRole("checkbox", {
      name: "Tick every file in server/lib",
    });
-    expect(box).toBeChecked();
+    // The default ticks land in an effect after the list renders.
+    await waitFor(() => expect(box).toBeChecked());
    await user.click(box);
    expect(tickOf("server/lib/git-ops.js")).not.toBeChecked();
    await user.click(folder);
@@ -765,7 +765,7 @@ export function Divider({
  onRatio,
  label,
 }: {
-  gridRef: React.RefObject<HTMLDivElement>;
+  gridRef: React.RefObject<HTMLDivElement | null>;
  dir: SplitDir;
  at: number;
  box: Rect;
@@ -12,7 +12,8 @@
 *     remembered for the + menu's Recent uploads), and a panel row (Files,
 *     Changes, a context file or folder) dropped on it (`lib/promptAttach.ts`)
 *     as an `@path` chip — so is a local file a browser on the dashboard's
- *     own machine drops or pastes with its `file://` path, never uploaded —
+ *     own machine drops or pastes with its `file://` path, or pastes from a
+ *     file manager's Copy its OS clipboard holds, never uploaded —
 *     a `bare` one takes a drop anywhere on its box;
 *     its `/command` and `@path` tokens are coloured by a mirror laid over
 *     the textarea (`lib/promptTokens.ts`);
@@ -78,6 +79,8 @@ import {
  localAttachment,
  localCandidates,
  sameFilesHere,
+  fileManagerPaths,
+  isClipboardBitmap,
  SKILL_MIME,
  rememberUploads,
 } from "../../lib/promptAttach";
@@ -463,21 +466,26 @@ export function PromptEditor({
  };
  /** Dropped or pasted files: by their own paths when the browser is on the
   *  dashboard's machine and the server finds the same files there (a file
-   *  manager hands over `file://` paths beside the bytes), else uploaded. */
+   *  manager hands over `file://` paths beside the bytes) or its file manager
+   *  holds them (a paste: its clipboard; a drop: its selection — no upload,
+   *  no size limit), else uploaded. */
  const attachDropped = (
    dt: DataTransfer | null | undefined,
-    list: FileList | null | undefined
+    list: FileList | File[] | null | undefined,
+    from: "paste" | "drop"
  ) => {
    const files = Array.from(list ?? []);
    if (files.length === 0) return false;
-    const paths = localCandidates(dt, files);
-    if (!paths) return attachImages(files);
+    if (!isLocalBrowser()) return attachImages(files);
+    const candidates = localCandidates(dt, files);
    setUpload("uploading");
-    void sameFilesHere(paths, files).then((same) => {
-      if (!same) return void attachImages(files);
+    void (async () => {
+      let paths = candidates && (await sameFilesHere(candidates, files)) ? candidates : null;
+      paths ??= await fileManagerPaths(files, from);
+      if (!paths) return void attachImages(files);
      setUpload(null);
      onImagesChange((prev) => addAttachments(prev, paths.map(localAttachment)));
-    });
+    })();
    return true;
  };
  // Anything attached since — a path, a panel row, a + menu pick — ends a past
@@ -518,7 +526,7 @@ export function PromptEditor({
    } else if (skill) {
      e.preventDefault();
      onChange(`/${skill} ${value.replace(/^\s+/, "")}`);
-    } else if (attachDropped(e.dataTransfer, e.dataTransfer?.files)) e.preventDefault();
+    } else if (attachDropped(e.dataTransfer, e.dataTransfer?.files, "drop")) e.preventDefault();
    else {
      // Only text (a file manager's or an editor's `file://` list, a
      // selection, a link): what the terminal beneath would paste.
@@ -683,17 +691,21 @@ export function PromptEditor({
          onBlur={() => setTrigger(null)}
          onKeyDown={handleKeyDown}
          onPaste={(e) => {
-            if (attachDropped(e.clipboardData, e.clipboardData?.files)) e.preventDefault();
-            else if (pastedLocalFiles(e.clipboardData)) e.preventDefault();
-            else {
+            const pasted = Array.from(e.clipboardData?.files ?? []);
+            const text = e.clipboardData?.getData?.("text/plain") ?? "";
+            // Cells from a spreadsheet come with a picture of them: the text
+            // is what was copied (isClipboardBitmap).
+            const textWithPicture =
+              pasted.length > 0 && pasted.every(isClipboardBitmap) && !!text.trim();
+            if (!textWithPicture && attachDropped(e.clipboardData, pasted, "paste"))
+              e.preventDefault();
+            else if (!textWithPicture && pastedLocalFiles(e.clipboardData)) e.preventDefault();
+            else if (text.length > PASTE_AS_FILE_CHARS) {
              // A very long paste goes in as a text file, like Claude Desktop:
              // the prompt then carries its path, never the text (#68: a CLI's
              // argument and a tmux message both have a size limit).
-              const text = e.clipboardData?.getData("text/plain") ?? "";
-              if (text.length > PASTE_AS_FILE_CHARS) {
-                e.preventDefault();
-                attachImages([new File([text], "pasted-text.txt", { type: "text/plain" })]);
-              }
+              e.preventDefault();
+              attachImages([new File([text], "pasted-text.txt", { type: "text/plain" })]);
            }
          }}
          placeholder={placeholder}
@@ -20,7 +20,11 @@
 * reads them when the prompt is sent — an image as its bare path, which claude
 * shows as `[Image #n]` like a native drop — except a PASTED image in a
 * `claude` pane of a local-mode dashboard opened on its own machine, which is
- * sent as ^V so `claude` reads the desktop clipboard itself, uploading nothing
+ * sent as its image-paste key (^V; Alt+V on Windows) so `claude` reads the
+ * desktop clipboard itself, uploading nothing — and a file manager's files
+ * pasted or dropped on that machine go in by the paths it holds them under
+ * (its clipboard / its selection: `POST /api/run/clipboard-files`,
+ * `selected-files`), with no upload and no size limit
 * (`lib/nativePaste.ts`, a Settings switch); a browser on the dashboard's own
 * machine pastes a file manager's files (dropped, or copied: `file://` text)
 * by their own paths instead, uploading nothing. A text drag (a Files/Changes row, a skill) is pasted as its text. The pane also registers with
@@ -44,7 +48,9 @@
 * most every 150 ms. Several browsers on one pane share ONE size: the server
 * names a driver (see pty-attach.js) and the others FOLLOW — their xterm takes
 * the driver's grid (`size`), scaled down to fit, until a click or a keystroke
- * here takes the lead back (`resize` with `drive: true`).
+ * here takes the lead back (`resize` with `drive: true`). Cells are drawn by
+ * the WebGL addon (the DOM renderer after a lost context), and Alt+arrow keeps
+ * the word-move keys xterm 5 sent (`altArrowSeq`).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import {
@@ -59,7 +65,7 @@ import {
 } from "react";
 import { useTranslation } from "react-i18next";
 import type { Terminal } from "@xterm/xterm";
-import type { CanvasAddon } from "@xterm/addon-canvas";
+import type { WebglAddon } from "@xterm/addon-webgl";
 import type { ClipboardAddon, IClipboardProvider } from "@xterm/addon-clipboard";
 import type { SearchAddon } from "@xterm/addon-search";
 import { ArrowDown, ArrowUp, X } from "lucide-react";
@@ -72,18 +78,20 @@ import { MENU_CURSOR_ROW, notePaneFocus, notePaneOutput, registerPane } from "..
 import {
  claudePastes,
  copiedFilePaths,
+  isClipboardBitmap,
  droppedFilePaths,
+  fileManagerPaths,
  isLocalBrowser,
  localCandidates,
  sameFilesHere,
 } from "../../lib/promptAttach";
 import { attachImeInput } from "../../lib/imeInput";
-import { readNativePaste } from "../../lib/nativePaste";
+import { nativePasteKey, nativePasteWorks, readNativePaste } from "../../lib/nativePaste";
 import { usePermissions } from "../AuthGate";
 import { TERMINAL_FONTS, readTerminalFont } from "../../lib/terminalFont";
 import { FONT_SIZE_EVENT, readTerminalFontSize } from "../../lib/fontSize";

-type DropState = "hint" | "paste" | "uploading" | "failed" | "tooBig" | "tooBigLocal";
+type DropState = "hint" | "paste" | "uploading" | "failed" | "tooBig" | "tooBigLocalPaste";

 /** localStorage flag for xterm's screen-reader mode (a Settings toggle can set it later). */
 export const SCREEN_READER_KEY = "agenthub.terminal.screenReader";
@@ -117,10 +125,10 @@ const clipboardProvider: IClipboardProvider = {
 *  Workspace chunk. The result is cached, so every later pane (and a test that
 *  awaits `loadXterm()` first) sets up synchronously. */
 const importXterm = async () => {
-  const [xterm, fit, canvas, clipboard, search, links] = await Promise.all([
+  const [xterm, fit, webgl, clipboard, search, links] = await Promise.all([
    import("@xterm/xterm"),
    import("@xterm/addon-fit"),
-    import("@xterm/addon-canvas"),
+    import("@xterm/addon-webgl"),
    import("@xterm/addon-clipboard"),
    import("@xterm/addon-search"),
    import("@xterm/addon-web-links"),
@@ -128,7 +136,7 @@ const importXterm = async () => {
  return {
    Terminal: xterm.Terminal,
    FitAddon: fit.FitAddon,
-    CanvasAddon: canvas.CanvasAddon,
+    WebglAddon: webgl.WebglAddon,
    SearchAddon: search.SearchAddon,
    WebLinksAddon: links.WebLinksAddon,
    // The addon's typings declare one argument, its code takes (base64, provider).
@@ -152,6 +160,25 @@ export function loadXterm(): Promise<Xterm> {
  return xtermLoading;
 }

+const IS_MAC = /^Mac/.test(typeof navigator === "undefined" ? "" : navigator.platform);
+/** What xterm 5 sent for a bare Alt+arrow (its Keyboard.ts "HACK"s, removed
+ *  in xterm 6): Ctrl+arrow's sequence, except macOS's left/right, which are
+ *  readline's backward-word / forward-word and whose up/down stay Alt's. */
+export function altArrowSeq(key: string, mac = IS_MAC): string | null {
+  switch (key) {
+    case "ArrowLeft":
+      return mac ? "\x1bb" : "\x1b[1;5D";
+    case "ArrowRight":
+      return mac ? "\x1bf" : "\x1b[1;5C";
+    case "ArrowUp":
+      return mac ? null : "\x1b[1;5A";
+    case "ArrowDown":
+      return mac ? null : "\x1b[1;5B";
+    default:
+      return null;
+  }
+}
+
 /** Reconnect delay: 1.5 s, doubling per failed attempt up to 30 s. */
 const RETRY_MIN_MS = 1500;
 const RETRY_MAX_MS = 30_000;
@@ -245,6 +272,11 @@ export const TerminalView = memo(function TerminalView({
  // Ctrl+V was pressed and its paste has not arrived yet (see the key handler).
  const ctrlVRef = useRef(false);
  const { local: localMode } = usePermissions();
+  // Ask early whether `^V` can reach this machine's clipboard, so the first
+  // pasted screenshot already takes the right way.
+  useEffect(() => {
+    if (tool === "claude" && localMode && isLocalBrowser()) nativePasteWorks();
+  }, [tool, localMode]);

  const onDrop = (e: DragEvent) => {
    if (hasText(e)) {
@@ -262,7 +294,7 @@ export const TerminalView = memo(function TerminalView({
    e.preventDefault();
    dragDepth.current = 0;
    const files = Array.from(e.dataTransfer.files);
-    void attachFiles(files, localCandidates(e.dataTransfer, files));
+    void attachFiles(files, localCandidates(e.dataTransfer, files), "drop");
  };

  // A pasted image (a screenshot) goes the way of a drop: xterm only reads
@@ -283,6 +315,9 @@ export const TerminalView = memo(function TerminalView({
      return;
    }
    if (files.length === 0 && (!ctrlV || e.clipboardData?.getData("text/plain"))) return;
+    // Cells from a spreadsheet, a page's selection: text WITH a picture of
+    // it. A terminal pastes the text there, so does this.
+    if (files.every(isClipboardBitmap) && e.clipboardData?.getData("text/plain")?.trim()) return;
    e.preventDefault();
    e.stopPropagation();
    // On the dashboard's own machine the browser's clipboard IS the pane's:
@@ -293,13 +328,14 @@ export const TerminalView = memo(function TerminalView({
      localMode &&
      isLocalBrowser() &&
      readNativePaste() &&
+      nativePasteWorks() &&
      files.length > 0 &&
-      files.every((f) => f.type.startsWith("image/"));
+      files.every(isClipboardBitmap);
    if (nativeImage) {
-      termRef.current?.input("\x16", true);
+      termRef.current?.input(nativePasteKey(), true);
      return;
    }
-    if (files.length > 0) void attachFiles(files, localCandidates(e.clipboardData, files));
+    if (files.length > 0) void attachFiles(files, localCandidates(e.clipboardData, files), "paste");
    else termRef.current?.input("\x16", true);
  };

@@ -319,11 +355,15 @@ export const TerminalView = memo(function TerminalView({
  /** Pastes the files' paths: their own (`local`, the `file://` paths a
   *  browser on the dashboard's machine is handed beside the bytes) once the
   *  server finds the same files there — nothing uploaded —, else the paths
-   *  the uploads were saved at. A refused file does not cost the others. */
-  const attachFiles = async (files: File[], local: string[] | null = null) => {
+   *  that machine's file manager holds them under (a paste: its clipboard; a
+   *  drop: its selection, what the drag carries — no upload, no size limit,
+   *  as a native terminal), else the paths the uploads were saved at. A
+   *  refused file does not cost the others. */
+  const attachFiles = async (files: File[], local: string[] | null, from: "paste" | "drop") => {
    if (files.length === 0) return;
    setDrop("uploading");
    let paths = local && (await sameFilesHere(local, files)) ? local : null;
+    paths ??= await fileManagerPaths(files, from);
    const errors: unknown[] = [];
    if (!paths) {
      const results = await Promise.allSettled(files.map((f) => api.run.dropFile(f, runId)));
@@ -341,7 +381,8 @@ export const TerminalView = memo(function TerminalView({
    if (tooBig) setLimitMb(Math.round((tooBig.maxBytes ?? 0) / 1024 / 1024));
    if (!errors.length) setDrop(null);
    else if (!tooBig) flash("failed");
-    else flash(isLocalBrowser() ? "tooBigLocal" : "tooBig", 6000); // a sentence to read
+    // A terminal has no + menu: on this machine, a paste goes by path.
+    else flash(isLocalBrowser() ? "tooBigLocalPaste" : "tooBig", 6000); // a sentence to read
  };

  useEffect(() => {
@@ -349,7 +390,7 @@ export const TerminalView = memo(function TerminalView({
    const attach = ({
      Terminal,
      FitAddon,
-      CanvasAddon,
+      WebglAddon,
      SearchAddon,
      WebLinksAddon,
      ClipboardWithProvider,
@@ -359,7 +400,7 @@ export const TerminalView = memo(function TerminalView({
      // which on Windows lacks Vietnamese precomposed diacritics — the OS then
      // substitutes those specific glyphs from a different face with a
      // mismatched advance width, corrupting the cell it's drawn into even
-      // under the canvas renderer (which only stops a glyph from shoving its
+      // under the WebGL renderer (which only stops a glyph from shoving its
      // *neighbours*, not from overflowing its own cell). JetBrains Mono is
      // already bundled for the rest of the UI; main.tsx additionally imports
      // its `vietnamese` subset so this covers the diacritics too. Settings →
@@ -405,17 +446,30 @@ export const TerminalView = memo(function TerminalView({
      // face whose advance width differs, so glyphs shove their neighbours along
      // and the row's tail spills onto the row below. The buffer is correct
      // throughout (copying the line yields clean text); only the painting drifts,
-      // and no CSS can correct it. Best-effort: a browser that cannot give a 2D
-      // context keeps the DOM renderer rather than losing the terminal.
-      let canvas: CanvasAddon | null = null;
+      // and no CSS can correct it. xterm 6 dropped its canvas renderer, so the
+      // cells are drawn by the WebGL one. Best-effort: a browser with no WebGL2
+      // keeps the DOM renderer rather than losing the terminal, and so does a
+      // pane whose context the browser takes back (GPU reset, or past the
+      // browser's cap of live contexts with many panes open) — disposing the
+      // addon hands the drawing back to the DOM renderer.
+      let gpu: WebglAddon | null = null;
      try {
-        canvas = new CanvasAddon();
-        term.loadAddon(canvas);
+        const addon = new WebglAddon();
+        term.loadAddon(addon);
+        gpu = addon;
+        addon.onContextLoss(() => {
+          addon.dispose();
+          if (gpu === addon) gpu = null;
+        });
      } catch {
-        canvas = null;
+        gpu = null;
      }

-      fit.fit();
+      // A terminal mounted on a hidden tab sits in a 0×0 box (`display:none`):
+      // fitting it there shrinks xterm to its 12×6 minimum, and that size would
+      // reach tmux with the attach. It stays unfitted until it is shown.
+      const hasBox = () => !!containerRef.current?.clientWidth && !!containerRef.current.clientHeight;
+      if (hasBox()) fit.fit();
      // Take the keyboard as soon as the pane is on screen: the terminal IS the
      // page here, and having to click it first meant the first thing typed went
      // nowhere. A click elsewhere still moves focus away, as in any editor.
@@ -502,6 +556,17 @@ export const TerminalView = memo(function TerminalView({
          term.input("\x1f", true);
          return false;
        }
+        // Alt+arrow moves by word, as it did before xterm 6 dropped its own
+        // mapping (xterm.js #5346): Ctrl+arrow's sequence, or readline's
+        // ESC b / ESC f for left/right on macOS — the same keys tmux,
+        // bash and claude's prompt have always been handed from this pane.
+        const altArrow =
+          ev.altKey && !ev.ctrlKey && !ev.metaKey && !ev.shiftKey ? altArrowSeq(ev.key) : null;
+        if (altArrow) {
+          ev.preventDefault();
+          term.input(altArrow, true);
+          return false;
+        }
        if (ev.key === "Tab" && tabMovesRef.current) return false;
        if (ev.key === "Tab" && ev.shiftKey) ev.preventDefault();
        return true;
@@ -544,7 +609,7 @@ export const TerminalView = memo(function TerminalView({
       */
      const sendSizeNow = (drive = false) => {
        if (!ws || ws.readyState !== WebSocket.OPEN) return;
-        if (term.cols < 2 || term.rows < 2) return;
+        if (!hasBox() || term.cols < 2 || term.rows < 2) return;
        ws.send(JSON.stringify({ type: "resize", cols: term.cols, rows: term.rows, drive }));
      };
      // This browser is the one in use now: back to its own size, and the
@@ -581,7 +646,10 @@ export const TerminalView = memo(function TerminalView({
        // scrollback as torn fragments along the left margin, visible as soon as
        // you scroll back (issue #33). Happens on every attach: page load,
        // lane switch, and each reconnect.
-        const size = term.cols > 1 && term.rows > 1 ? `?cols=${term.cols}&rows=${term.rows}` : "";
+        // A hidden terminal sends none: the server attaches it at the window's
+        // own size, so a pane on a background tab is never resized by it.
+        const size =
+          hasBox() && term.cols > 1 && term.rows > 1 ? `?cols=${term.cols}&rows=${term.rows}` : "";
        const sock = new WebSocket(`${wsBaseUrl}/ws-pty/${encodeURIComponent(runId)}${size}`);
        ws = sock;
        wsRef.current = sock;
@@ -676,6 +744,9 @@ export const TerminalView = memo(function TerminalView({
        if (!el || !el.clientWidth || !el.clientHeight) return;
        if (follow) return scaleToFit(); // the driver's grid, not ours
        fit.fit(); // a real change fires onResize, which reports it
+        // A tab shown for the first time may fit to the very size xterm already
+        // had (no onResize), yet tmux has never heard it: report it anyway.
+        sendSize();
      };
      const resizeObserver = new ResizeObserver(refit);
      if (containerRef.current) resizeObserver.observe(containerRef.current);
@@ -714,7 +785,7 @@ export const TerminalView = memo(function TerminalView({
        resizeDisposable.dispose();
        dataDisposable.dispose();
        ws?.close();
-        canvas?.dispose();
+        gpu?.dispose();
        term.dispose();
        termRef.current = null;
      };
@@ -959,7 +1030,7 @@ export const TerminalView = memo(function TerminalView({
        <div
          data-testid="terminal-drop"
          className={`pointer-events-none absolute inset-2 flex items-center justify-center rounded-lg border-2 border-dashed bg-black/50 text-sm font-medium ${
-            drop === "failed" || drop === "tooBig" || drop === "tooBigLocal"
+            drop === "failed" || drop === "tooBig" || drop === "tooBigLocalPaste"
              ? "border-red-400 text-red-300"
              : "border-sky-400 text-sky-200"
          }`}
@@ -60,6 +60,8 @@ vi.mock("../../../lib/api", async (importOriginal) => {
        files: r({ items: [] }),
        dropFile: r({ path: "/tmp/agenthub-drops-1/a.png" }),
        localPaths: r({ sizes: [1] }),
+        clipboardFiles: r({ files: [] }),
+        selectedFiles: r({ files: [] }),
      },
      ccConfig: {
        commands: r({
@@ -377,6 +379,35 @@ describe("PromptEditor — newlines and images", () => {
    expect(screen.getByTestId("sent").textContent).toBe("read @/home/u/demo.mp4");
  });

+  // Chrome on Windows pastes a file manager's copy as bytes only: the path
+  // comes off the OS clipboard, so a file over the upload limit attaches too.
+  it("attaches a pasted file manager copy by the path the OS clipboard holds", async () => {
+    vi.mocked(api.run.clipboardFiles).mockResolvedValueOnce({
+      files: [{ path: "C:\\Users\\u\\big.iso", size: 3_000_000_000, dir: false }],
+    });
+    vi.mocked(api.run.dropFile).mockClear();
+    const onImagesChange = vi.fn();
+    render(
+      <PromptEditor
+        value=""
+        onChange={() => {}}
+        onSubmit={() => {}}
+        placeholder="Ask anything…"
+        slash={false}
+        fileCwd="/home/u"
+        images={[]}
+        onImagesChange={onImagesChange}
+      />
+    );
+    const iso = new File(["x"], "big.iso");
+    Object.defineProperty(iso, "size", { value: 3_000_000_000 });
+    fireEvent.paste(box(), { clipboardData: { files: [iso], getData: () => "" } });
+    await vi.waitFor(() => expect(onImagesChange).toHaveBeenCalled());
+    const update = onImagesChange.mock.calls[0]![0] as (p: unknown[]) => { path: string }[];
+    expect(update([]).map((a) => a.path)).toEqual(["@C:/Users/u/big.iso"]);
+    expect(api.run.dropFile).not.toHaveBeenCalled();
+  });
+
  it("uploads a dropped file whose path the server does not have (an SSH tunnel's laptop)", async () => {
    vi.mocked(api.run.localPaths).mockResolvedValueOnce({ sizes: [null] });
    const onImagesChange = vi.fn();
@@ -6,13 +6,24 @@
 * included) as outgoing binary frames, and
 * re-attaches after the socket drops (server restart) with backoff, but not
 * after `exit` or a policy close,
- * and recolours live on a dark-theme change without re-attaching.
+ * recolours live on a dark-theme change without re-attaching, draws through
+ * the WebGL addon (DOM renderer again on a lost context) and keeps xterm 5's
+ * Alt+arrow word moves.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
-import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from "vitest";
-import { render, cleanup, act, fireEvent, screen, waitFor } from "@testing-library/react";
-import { TerminalView, loadXterm } from "../TerminalView";
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, onTestFinished } from "vitest";
+import {
+  render,
+  cleanup,
+  act,
+  createEvent,
+  fireEvent,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { TerminalView, altArrowSeq, loadXterm } from "../TerminalView";
 import { pasteToLane, pasteToRun } from "../../../lib/panePaste";
+import { __resetNativePaste, nativePasteWorks } from "../../../lib/nativePaste";

 const writeMock = vi.fn();
 const onDataHandlers: Array<(d: string) => void> = [];
@@ -27,11 +38,18 @@ const inputMock = vi.fn();
 let textarea: HTMLTextAreaElement;
 const dropFileMock = vi.fn();
 const localPathsMock = vi.fn();
+const nativePasteMock = vi.fn(() => Promise.resolve({ native: true }));
+type Held = { files: { path: string; size: number | null; dir: boolean }[] };
+const clipboardFilesMock = vi.fn((): Promise<Held> => Promise.resolve({ files: [] }));
+const selectedFilesMock = vi.fn((): Promise<Held> => Promise.resolve({ files: [] }));
 vi.mock("../../../lib/api", () => ({
  api: {
    run: {
      dropFile: (f: File, lane?: string) => dropFileMock(f, lane),
      localPaths: (paths: string[]) => localPathsMock(paths),
+      nativePaste: () => nativePasteMock(),
+      clipboardFiles: () => clipboardFilesMock(),
+      selectedFiles: () => selectedFilesMock(),
    },
  },
 }));
@@ -93,8 +111,24 @@ vi.mock("../../../lib/terminalTheme", () => ({
 vi.mock("@xterm/addon-fit", () => ({
  FitAddon: vi.fn().mockImplementation(() => ({ fit: vi.fn() })),
 }));
-vi.mock("@xterm/addon-canvas", () => ({
-  CanvasAddon: vi.fn().mockImplementation(() => ({ __canvas: true, dispose: vi.fn() })),
+// The newest WebGL addon, with the context-loss listener the view gave it.
+const gpu: { last: { dispose: ReturnType<typeof vi.fn>; lose: () => void } | null } = {
+  last: null,
+};
+vi.mock("@xterm/addon-webgl", () => ({
+  WebglAddon: vi.fn().mockImplementation(() => {
+    let onLoss = () => {};
+    const addon = {
+      __webgl: true,
+      dispose: vi.fn(),
+      onContextLoss: (fn: () => void) => {
+        onLoss = fn;
+        return { dispose: vi.fn() };
+      },
+    };
+    gpu.last = { dispose: addon.dispose, lose: () => onLoss() };
+    return addon;
+  }),
 }));

 class MockWebSocket {
@@ -120,6 +154,17 @@ class MockWebSocket {
 // @ts-expect-error test override
 global.WebSocket = MockWebSocket;

+/** Give every element a real box (jsdom's are 0×0, like a terminal on a hidden
+ *  tab); returns the restore. */
+function withBox(width = 800, height = 600) {
+  const w = vi.spyOn(HTMLElement.prototype, "clientWidth", "get").mockReturnValue(width);
+  const h = vi.spyOn(HTMLElement.prototype, "clientHeight", "get").mockReturnValue(height);
+  return () => {
+    w.mockRestore();
+    h.mockRestore();
+  };
+}
+
 describe("TerminalView", () => {
  // xterm is a lazy chunk; once loaded every terminal sets up synchronously.
  beforeAll(() => loadXterm());
@@ -151,11 +196,51 @@ describe("TerminalView", () => {
    // it: tmux resizes the window to the newest client, so attaching at the
    // server's default 80x24 makes claude redraw its UI at 80 columns and
    // leaves that width in the scrollback (issue #33).
-    render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
-    expect(MockWebSocket.instances).toHaveLength(1);
-    expect(MockWebSocket.instances[0]!.url).toBe(
-      "ws://localhost:4820/ws-pty/agenthub-lane-1?cols=131&rows=28"
-    );
+    const restore = withBox();
+    try {
+      render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+      expect(MockWebSocket.instances).toHaveLength(1);
+      expect(MockWebSocket.instances[0]!.url).toBe(
+        "ws://localhost:4820/ws-pty/agenthub-lane-1?cols=131&rows=28"
+      );
+    } finally {
+      restore();
+    }
+  });
+
+  it("a terminal on a hidden tab sends no size until it is shown", () => {
+    // Its box is 0×0 (display:none): fitting there shrank xterm to 12×6 and
+    // that size resized the real tmux pane under every other client.
+    let observed: (() => void) | null = null;
+    const RO = globalThis.ResizeObserver;
+    // @ts-expect-error test override
+    globalThis.ResizeObserver = class {
+      constructor(cb: () => void) {
+        observed = cb;
+      }
+      observe() {}
+      disconnect() {}
+    };
+    vi.useFakeTimers();
+    let restore = () => {};
+    try {
+      render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+      const ws = MockWebSocket.instances[0]!;
+      expect(ws.url).toBe("ws://localhost:4820/ws-pty/agenthub-lane-1");
+      ws.onopen?.();
+      expect(ws.sent).toEqual([]);
+      // The tab is shown: the box gets a size and its size reaches tmux.
+      restore = withBox();
+      observed!();
+      vi.advanceTimersByTime(200);
+      expect(ws.sent).toEqual([
+        JSON.stringify({ type: "resize", cols: 131, rows: 28, drive: false }),
+      ]);
+    } finally {
+      restore();
+      vi.useRealTimers();
+      globalThis.ResizeObserver = RO;
+    }
  });

  it("omits the size when the terminal has none yet (a collapsed console is 0x0)", () => {
@@ -381,34 +466,75 @@ describe("TerminalView", () => {
    expect(onExit).toHaveBeenCalledTimes(1);
  });

-  it("renders through the canvas addon, not xterm's DOM renderer", () => {
+  it("renders through the WebGL addon, not xterm's DOM renderer", () => {
    // The DOM renderer aligns a row with one `letter-spacing`, which holds only
    // while every glyph shares a font. Vietnamese diacritics and CJK fall to a
    // fallback face with a different advance, so glyphs shove their neighbours
    // and the row's tail spills onto the row below — buffer clean, painting
-    // wrong. The canvas renderer draws each cell at a fixed position instead.
+    // wrong. The WebGL renderer draws each cell at a fixed position instead
+    // (xterm 6 removed the canvas one).
    render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
-    expect(loadAddonMock.mock.calls.some(([a]) => (a as { __canvas?: boolean }).__canvas)).toBe(
+    expect(loadAddonMock.mock.calls.some(([a]) => (a as { __webgl?: boolean }).__webgl)).toBe(
      true
    );
  });

+  it("falls back to the DOM renderer when the browser takes the WebGL context back", () => {
+    render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+    const addon = gpu.last!;
+    expect(addon.dispose).not.toHaveBeenCalled();
+    addon.lose();
+    expect(addon.dispose).toHaveBeenCalledTimes(1);
+    expect(disposeMock).not.toHaveBeenCalled(); // the terminal itself lives on
+  });
+
+  // xterm 6 dropped its own Alt+arrow → word-move mapping; the pane keeps it.
+  it("sends Alt+arrow as the word-move keys xterm 5 sent", () => {
+    expect(altArrowSeq("ArrowLeft", false)).toBe("\x1b[1;5D");
+    expect(altArrowSeq("ArrowRight", false)).toBe("\x1b[1;5C");
+    expect(altArrowSeq("ArrowUp", false)).toBe("\x1b[1;5A");
+    expect(altArrowSeq("ArrowDown", false)).toBe("\x1b[1;5B");
+    expect(altArrowSeq("ArrowLeft", true)).toBe("\x1bb");
+    expect(altArrowSeq("ArrowRight", true)).toBe("\x1bf");
+    expect(altArrowSeq("ArrowUp", true)).toBeNull();
+    expect(altArrowSeq("a", false)).toBeNull();
+
+    inputMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" />);
+    const handler = keyHandlerMock.mock.calls[0]![0]! as (e: KeyboardEvent) => boolean;
+    const ev = new KeyboardEvent("keydown", { key: "ArrowLeft", altKey: true, cancelable: true });
+    expect(handler(ev)).toBe(false);
+    expect(ev.defaultPrevented).toBe(true);
+    expect(inputMock).toHaveBeenCalledWith(altArrowSeq("ArrowLeft"), true);
+    // Another modifier with it is xterm's own sequence.
+    expect(
+      handler(new KeyboardEvent("keydown", { key: "ArrowLeft", altKey: true, shiftKey: true }))
+    ).toBe(true);
+  });
+
  describe("size reporting (tmux must never be wider than the terminal)", () => {
    // A tmux pane wider than xterm wraps each over-long row's tail onto the
    // next row's left margin, and tmux never repaints a row it believes
    // unchanged — the stray characters glued to the left edge after scrolling.
    it("reports its size when the socket opens", () => {
-      render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
-      const ws = MockWebSocket.instances[0]!;
-      ws.onopen?.();
-      expect(ws.sent).toContain(
-        JSON.stringify({ type: "resize", cols: 131, rows: 28, drive: false })
-      );
+      const restore = withBox();
+      try {
+        render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+        const ws = MockWebSocket.instances[0]!;
+        ws.onopen?.();
+        expect(ws.sent).toContain(
+          JSON.stringify({ type: "resize", cols: 131, rows: 28, drive: false })
+        );
+      } finally {
+        restore();
+      }
    });

    it("reports a size change xterm made on its own, with no container resize", async () => {
      // Webfont load and page zoom both move cols without resizing the element
      // ResizeObserver watches, which is why onResize is the hook.
+      const restore = withBox();
+      onTestFinished(restore);
      render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
      const ws = MockWebSocket.instances[0]!;
      ws.onopen?.();
@@ -590,11 +716,13 @@ describe("TerminalView", () => {
    expect(dropFileMock).toHaveBeenCalledWith(img, "r1");
  });

-  it("hands a local claude pane's pasted image to claude as ^V, uploading nothing", () => {
+  it("hands a local claude pane's pasted image to claude as ^V, uploading nothing", async () => {
+    __resetNativePaste();
    dropFileMock.mockReset();
    inputMock.mockClear();
    pasteMock.mockClear();
    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteWorks()).toBe(true));
    const img = new File([new Uint8Array([137, 80])], "image.png", { type: "image/png" });
    fireEvent.paste(screen.getByTestId("terminal-view"), {
      clipboardData: { files: [img], getData: () => "" },
@@ -604,6 +732,41 @@ describe("TerminalView", () => {
    expect(pasteMock).not.toHaveBeenCalled();
  });

+  // Claude Code on Windows binds its image paste to Alt+V; a ^V did nothing.
+  it("sends Alt+V instead of ^V when the dashboard runs on Windows", async () => {
+    __resetNativePaste();
+    nativePasteMock.mockResolvedValueOnce({ native: true, key: "alt+v" } as never);
+    dropFileMock.mockReset();
+    inputMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteWorks()).toBe(true));
+    const img = new File([new Uint8Array([137, 80])], "image.png", { type: "image/png" });
+    fireEvent.paste(screen.getByTestId("terminal-view"), {
+      clipboardData: { files: [img], getData: () => "" },
+    });
+    expect(inputMock).toHaveBeenCalledWith("\x1bv", true);
+    expect(inputMock).not.toHaveBeenCalledWith("\x16", true);
+    expect(dropFileMock).not.toHaveBeenCalled();
+  });
+
+  // No wl-paste/xclip (or no display) on the dashboard's machine: ^V would
+  // paste nothing, so the screenshot is uploaded like a remote browser's.
+  it("uploads a claude pane's pasted image when the machine cannot read its clipboard", async () => {
+    __resetNativePaste();
+    nativePasteMock.mockResolvedValueOnce({ native: false });
+    dropFileMock.mockReset().mockResolvedValue({ path: "/tmp/agenthub-drops-1/ab-image.png" });
+    inputMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteMock).toHaveBeenCalled());
+    await Promise.resolve();
+    const img = new File([new Uint8Array([137, 80])], "image.png", { type: "image/png" });
+    fireEvent.paste(screen.getByTestId("terminal-view"), {
+      clipboardData: { files: [img], getData: () => "" },
+    });
+    await waitFor(() => expect(dropFileMock).toHaveBeenCalledWith(img, "r1"));
+    expect(inputMock).not.toHaveBeenCalledWith("\x16", true);
+  });
+
  it("uploads a claude pane's pasted image once native paste is turned off", async () => {
    localStorage.setItem("agenthub.terminal.nativePaste", "off");
    dropFileMock.mockReset().mockResolvedValue({ path: "/tmp/agenthub-drops-1/ab-image.png" });
@@ -621,6 +784,100 @@ describe("TerminalView", () => {
    }
  });

+  // A file manager's Copy reaches Chrome on Windows as bytes and a name only:
+  // the pane gets the file's own path off the OS clipboard — no upload, so
+  // no size limit (a 3 GB video too), as a native terminal pastes it.
+  it("pastes a copied file by the path the OS clipboard holds, uploading nothing", async () => {
+    __resetNativePaste();
+    dropFileMock.mockReset();
+    pasteMock.mockClear();
+    inputMock.mockClear();
+    clipboardFilesMock.mockResolvedValueOnce({
+      files: [{ path: "C:\\Users\\u\\Videos\\demo.mp4", size: 3_000_000_000, dir: false }],
+    });
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteWorks()).toBe(true));
+    const video = new File([new Uint8Array([1])], "demo.mp4", { type: "video/mp4" });
+    Object.defineProperty(video, "size", { value: 3_000_000_000 });
+    fireEvent.paste(screen.getByTestId("terminal-view"), {
+      clipboardData: { files: [video], getData: () => "" },
+    });
+    await waitFor(() => expect(pasteMock).toHaveBeenCalledWith("@C:/Users/u/Videos/demo.mp4 "));
+    expect(dropFileMock).not.toHaveBeenCalled();
+    expect(inputMock).not.toHaveBeenCalledWith("\x16", true);
+  });
+
+  // Chrome hands a file dragged from Explorer no path; the drag carries the
+  // items selected there, so the pane gets their own paths — as a native
+  // terminal types them — and nothing is uploaded, whatever the size.
+  it("drops a file manager's file by the path selected there, uploading nothing", async () => {
+    dropFileMock.mockReset();
+    pasteMock.mockClear();
+    selectedFilesMock.mockResolvedValueOnce({
+      files: [{ path: "C:\\Users\\u\\Videos\\big.mkv", size: 5_000_000_000, dir: false }],
+    });
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    const video = new File([new Uint8Array([1])], "big.mkv");
+    Object.defineProperty(video, "size", { value: 5_000_000_000 });
+    fireEvent.drop(screen.getByTestId("terminal-view"), {
+      dataTransfer: { files: [video], types: ["Files"], getData: () => "" },
+    });
+    await waitFor(() => expect(pasteMock).toHaveBeenCalledWith("@C:/Users/u/Videos/big.mkv "));
+    expect(dropFileMock).not.toHaveBeenCalled();
+  });
+
+  it("uploads a dropped file the file manager does not hold selected", async () => {
+    dropFileMock.mockReset().mockResolvedValue({ path: "/tmp/agenthub-drops-1/ab-notes.txt" });
+    selectedFilesMock.mockResolvedValueOnce({
+      files: [{ path: "/home/u/other.txt", size: 1, dir: false }],
+    });
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="codex" />);
+    const notes = new File(["x"], "notes.txt");
+    fireEvent.drop(screen.getByTestId("terminal-view"), {
+      dataTransfer: { files: [notes], types: ["Files"], getData: () => "" },
+    });
+    await waitFor(() => expect(dropFileMock).toHaveBeenCalledWith(notes, "r1"));
+  });
+
+  // A copied image FILE is not a screenshot: claude's own paste finds no
+  // picture on a clipboard holding a file, so it goes by path too.
+  it("pastes a copied image file by path instead of claude's image paste", async () => {
+    __resetNativePaste();
+    dropFileMock.mockReset();
+    pasteMock.mockClear();
+    inputMock.mockClear();
+    clipboardFilesMock.mockResolvedValueOnce({
+      files: [{ path: "/home/u/Pictures/logo.png", size: 2, dir: false }],
+    });
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteWorks()).toBe(true));
+    const logo = new File([new Uint8Array([137, 80])], "logo.png", { type: "image/png" });
+    fireEvent.paste(screen.getByTestId("terminal-view"), {
+      clipboardData: { files: [logo], getData: () => "" },
+    });
+    await waitFor(() => expect(pasteMock).toHaveBeenCalledWith("/home/u/Pictures/logo.png "));
+    expect(inputMock).not.toHaveBeenCalledWith("\x16", true);
+    expect(dropFileMock).not.toHaveBeenCalled();
+  });
+
+  // Cells from a spreadsheet come with a picture of them; a terminal pastes
+  // the text, so the browser's paste is left to xterm.
+  it("leaves text that comes with a picture of it to xterm's paste", async () => {
+    __resetNativePaste();
+    dropFileMock.mockReset();
+    inputMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" tool="claude" />);
+    await waitFor(() => expect(nativePasteWorks()).toBe(true));
+    const pic = new File([new Uint8Array([137, 80])], "image.png", { type: "image/png" });
+    const ev = createEvent.paste(screen.getByTestId("terminal-view"), {
+      clipboardData: { files: [pic], getData: (t: string) => (t === "text/plain" ? "a\tb" : "") },
+    });
+    fireEvent(screen.getByTestId("terminal-view"), ev);
+    expect(ev.defaultPrevented).toBe(false);
+    expect(inputMock).not.toHaveBeenCalled();
+    expect(dropFileMock).not.toHaveBeenCalled();
+  });
+
  // Ctrl+V is how claude pastes an image; xterm would send ^V, and claude then
  // reads the SERVER's clipboard, not the browser's. Text on the clipboard is
  // pasted like any browser paste: sending ^V for it pasted nothing.
@@ -79,14 +79,6 @@ function Step({ n, children }: { n: number; children: ReactNode }) {
  );
 }

-function Code({ children }: { children: ReactNode }) {
-  return (
-    <code className="mt-1 block break-all rounded bg-surface-2 px-1.5 py-1 font-mono text-[10px] text-fg-primary">
-      {children}
-    </code>
-  );
-}
-
 type Key = NonNullable<GitIdentity["sshKeys"]>[number];
 type SshUser = NonNullable<GitIdentity["sshUsers"]>[number];

@@ -642,10 +634,6 @@ export function GitIdentitySettings() {
                onRemove={() => removeKey("ed25519")}
              >
                <Step n={2}>{t("gitIdentity.gitHubStepAdd")}</Step>
-                <Step n={3}>
-                  {t("gitIdentity.gitHubStepClone")}
-                  <Code>git clone git@github.com:&lt;org&gt;/&lt;repo&gt;.git</Code>
-                </Step>
              </KeyCard>
              {namedOf("ed25519").map((k) => {
                const rows = rowsOf(otherRows, k);
@@ -668,11 +656,6 @@ export function GitIdentitySettings() {
                      {id.writable && rows.length === 0 && (
                        <GitHostForm busy={busy} onSave={(host) => saveGitHost(host, k)} />
                      )}
-                      {rows.map((r) => (
-                        <Code key={r.alias ?? r.host}>
-                          git clone ssh://{r.alias ?? r.host}/&lt;org&gt;/&lt;repo&gt;.git
-                        </Code>
-                      ))}
                    </Step>
                  </KeyCard>
                );
@@ -720,16 +703,6 @@ export function GitIdentitySettings() {
                        </>
                      )}
                    </Step>
-                    {rows.length > 0 && (
-                      <div className="rounded border border-status-success/40 bg-status-success/10 p-2 text-[11px] text-fg-primary">
-                        {t("gitIdentity.awsReady")}
-                        {rows.map((r) => (
-                          <Code key={r.alias ?? r.host}>
-                            git clone ssh://{r.alias ?? r.host}/v1/repos/&lt;repo&gt;
-                          </Code>
-                        ))}
-                      </div>
-                    )}
                  </KeyCard>
                );
              })}
@@ -65,7 +65,7 @@ const VIEW: AiToolsView = {
  tools: [
    tool("claude", "Claude Code"),
    tool("gemini", "Gemini"),
-    tool("grok", "Grok", { enabled: false }),
+    tool("goose", "Goose", { enabled: false }),
    tool("aider", "Aider", { installed: false, path: null }),
  ],
 };
@@ -155,9 +155,9 @@ describe("AiToolsSettings", () => {
    await user.click(within(gemini).getByText("Set default"));
    expect(api.aiTools.update).toHaveBeenCalledWith("gemini", { default: true });
    // A disabled tool cannot become the default.
-    const grok = screen.getByTestId("ai-tool-grok");
-    expect(within(grok).getByText("Set default")).toBeDisabled();
-    expect(within(grok).getByRole("switch")).toHaveAttribute("aria-checked", "false");
+    const goose = screen.getByTestId("ai-tool-goose");
+    expect(within(goose).getByText("Set default")).toBeDisabled();
+    expect(within(goose).getByRole("switch")).toHaveAttribute("aria-checked", "false");
  });

  it("refreshes detection", async () => {
@@ -179,7 +179,7 @@ describe("AiToolsSettings", () => {
    await user.click(screen.getByRole("menuitem", { name: "Disable" }));
    expect(api.aiTools.update).toHaveBeenCalledWith("gemini", { enabled: false });
    // A disabled tool cannot become the default from the menu either.
-    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("ai-tool-grok") });
+    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("ai-tool-goose") });
    expect(screen.getByRole("menuitem", { name: "Set default" })).toBeDisabled();
  });
 });
@@ -301,11 +301,9 @@ describe("AiToolsSettings — install and update", () => {
 describe("AiToolIcon", () => {
  it("retries the icon when the same instance shows another tool", async () => {
    const { AiToolIcon } = await import("../../AiToolIcon");
-    const { container, rerender } = render(
-      <AiToolIcon tool={{ id: "opencode", label: "OpenCode" }} />
-    );
+    const { container, rerender } = render(<AiToolIcon tool={{ id: "aider", label: "Aider" }} />);
    fireEvent.error(container.querySelector("img")!);
-    expect(screen.getByText("O")).toBeInTheDocument();
+    expect(screen.getByText("A")).toBeInTheDocument();
    rerender(<AiToolIcon tool={{ id: "cursor", label: "Cursor CLI" }} />);
    expect(container.querySelector('img[src="/api/ai-tools/cursor/icon"]')).toBeTruthy();
  });
@@ -156,7 +156,6 @@ describe("GitIdentitySettings", () => {
    await userEvent.click(within(aws).getByRole("button", { name: "Save" }));
    expect(api.gitIdentity.setSshUser).toHaveBeenCalledWith({ host: H, user: "APKA1" });
    expect(await within(aws).findByText("eu-west-1 · APKA1 · Any key")).toBeInTheDocument();
-    expect(within(aws).getByText(`git clone ssh://${H}/v1/repos/<repo>`)).toBeInTheDocument();
    // A CodeCommit host never shows up again under "other hosts".
    expect(screen.queryByText(`APKA1@${H}`)).toBeNull();
    await userEvent.click(within(aws).getByRole("button", { name: `Delete ${H}` }));
@@ -260,7 +259,6 @@ describe("GitIdentitySettings", () => {
    expect(
      await within(prod).findByText("aws-2 · ap-southeast-1 · APKA2 · aws-2")
    ).toBeInTheDocument();
-    expect(within(prod).getByText("git clone ssh://aws-2/v1/repos/<repo>")).toBeInTheDocument();
    // The default key's card does not list the named key's login.
    const def = screen.getByRole("region", { name: "AWS CodeCommit" });
    expect(within(def).queryByText(/APKA2/)).toBeNull();
@@ -301,7 +299,7 @@ describe("GitIdentitySettings", () => {
      key: "id_ed25519_git-2",
    });
    expect(
-      await within(work).findByText("git clone ssh://git-2/<org>/<repo>.git")
+      await within(work).findByText("ssh://git-2/ → git@github.com")
    ).toBeInTheDocument();
  });
 });
@@ -0,0 +1,41 @@
+/**
+ * @file useCcTarget — whose Claude Code config the Config Explorer manages for
+ * this login (GET /api/cc-config/target). Local mode and an admin: the host's,
+ * answered at once without a request (nothing changes for them). A non-admin
+ * in server mode asks the server: `own` when they have their own Linux account
+ * (S3) — Settings then shows "Your Claude Code config" — else `none` and the
+ * page stays hidden. The server's refusal (403 ENOACCOUNT/EADMIN) is the rule;
+ * this only hides what would be refused.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useState } from "react";
+import { api, type CcTarget } from "../lib/api";
+import { usePermissions } from "../components/AuthGate";
+
+const HOST: CcTarget = { kind: "host", readOnly: false, claudeHome: null };
+
+/** `null` while a non-admin's answer is on its way. */
+export function useCcTarget(): CcTarget | null {
+  const { isAdmin } = usePermissions();
+  const [target, setTarget] = useState<CcTarget | null>(isAdmin ? HOST : null);
+  useEffect(() => {
+    if (isAdmin) {
+      setTarget(HOST);
+      return;
+    }
+    let live = true;
+    api.ccConfig
+      .target()
+      .then((t) => {
+        if (live) setTarget(t);
+      })
+      .catch(() => {
+        if (live) setTarget({ kind: "none", readOnly: true, claudeHome: null });
+      });
+    return () => {
+      live = false;
+    };
+  }, [isAdmin]);
+  return target;
+}
@@ -27,9 +27,9 @@ const FOCUSABLE =
 */
 export function useDialog(
  open: boolean,
-  panelRef: RefObject<HTMLElement>,
+  panelRef: RefObject<HTMLElement | null>,
  onClose?: () => void,
-  initialFocus?: RefObject<HTMLElement>
+  initialFocus?: RefObject<HTMLElement | null>
 ): void {
  // Read through a ref so an inline `onClose` does not re-run the effect, which
  // would steal focus back to the first control on every parent render.
@@ -63,7 +63,7 @@ type MessageHandler = (msg: WSMessage) => void;
 * auto-reconnects with capped exponential backoff on close - plus an
 * immediate reconnect attempt on tab focus/network-online/visibility-change
 * so the socket recovers quickly after a server restart or laptop sleep.
- * Guards against React 18 StrictMode's mount→cleanup→remount cycle opening a
+ * Guards against React StrictMode's mount→cleanup→remount cycle opening a
 * duplicate socket (see the inline comment in `connect`).
 * @param onMessage Called with every message parsed from the socket; the
 *   latest reference is used even across reconnects (no stale closures).
@@ -73,7 +73,7 @@ export function useWebSocket(onMessage: MessageHandler) {
  const wsRef = useRef<WebSocket | null>(null);
  const handlersRef = useRef<MessageHandler>(onMessage);
  const [connected, setConnected] = useState(false);
-  const reconnectTimer = useRef<ReturnType<typeof setTimeout>>();
+  const reconnectTimer = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
  const mountedRef = useRef(true);
  const reconnectAttempts = useRef(0);

@@ -82,7 +82,7 @@ export function useWebSocket(onMessage: MessageHandler) {
  const connect = useCallback(() => {
    if (!mountedRef.current) return;
    // Don't open a second socket if one is already alive or in flight.
-    // Without this, React 18 StrictMode (mount → cleanup → remount in dev)
+    // Without this, React StrictMode (mount → cleanup → remount in dev)
    // and the close→reconnect race could leave two sockets connected at the
    // same time. Both would receive every server broadcast, producing
    // duplicate stream_event deltas (doubled text, duplicate assistant
@@ -34,7 +34,6 @@
  "download": "Download",
  "noPreview": "This file type cannot be shown here — download it to open it.",
  "install": "Install",
-  "installs": "{{count}} installs",
  "installed": "Installed to {{path}}",
  "installedPlugin": "Installed {{name}} — start a new session (or /reload-plugins) to use it",
  "rename": "Edit",
@@ -197,5 +196,32 @@
  "unowned.claimed": "Added to your library",
  "unowned.declined": "Removed from your list",
  "unowned.assigned": "Owner assigned",
-  "unowned.empty": "Nothing without an owner."
+  "unowned.empty": "Nothing without an owner.",
+  "installs_one": "{{count}} install",
+  "installs_other": "{{count}} installs",
+  "private": "Private",
+  "privateHint": "Not shared: only you (and admins) see it. Share puts it in the Hub.",
+  "showMore": "Show {{count}} more",
+  "view.label": "Layout",
+  "view.list": "List view",
+  "view.grid": "Grid view",
+  "pack.title": "{{prefix}}-* pack",
+  "pack.count_one": "{{count}} skill",
+  "pack.count_other": "{{count}} skills",
+  "pack.installAll": "Install all",
+  "pack.installRest": "Install {{count}} more",
+  "pack.installTitle": "Install {{count}} skills of {{prefix}}-*?",
+  "pack.installBody": "Each one is written into your own account. A skill you already have under the same name is left as it is:",
+  "pack.installed": "Installed {{ok}} · already there {{skipped}} · failed {{failed}}",
+  "section.unshared": "Not shared by their owners",
+  "section.unsharedHint": "Other users' private items — only admins see these",
+  "update": "Update",
+  "updateHint": "Its owner changed it since you installed it",
+  "updateTitle": "Update “{{title}}”?",
+  "updateBody": "Your copy of {{name}} is replaced by the newest version. The current one is moved to ~/.claude/agenthub-replaced-skills/, not deleted.",
+  "updated": "Updated {{name}}",
+  "pack.updateN": "Update {{count}}",
+  "pack.updateTitle": "Update {{count}} skills of {{prefix}}-*?",
+  "pack.updateBody": "Each copy is replaced by the newest version; the current ones are moved to ~/.claude/agenthub-replaced-skills/:",
+  "pack.updated": "Updated {{ok}} · failed {{failed}}"
 }
@@ -1,6 +1,10 @@
 {
  "title": "Claude Config Explorer",
  "subtitle": "Your Claude Code setup at a glance - plugins, skills, subagents, MCP servers, hooks, and settings.",
+  "own": {
+    "label": "Your Claude Code config — {{home}}",
+    "subtitle": "Only your own account's setup: every change here runs as your account and reaches only your own sessions."
+  },
  "refresh": "Refresh",
  "refreshing": "Refreshing…",
  "lastUpdated": "Last updated {{time}}",
@@ -30,6 +34,7 @@
  },
  "overview": {
    "rootsTitle": "Roots",
+    "claudeHome": "Your .claude",
    "projectClaudeDir": "Project .claude",
    "projectRoot": "Project root",
    "claudeJson": "claude.json",
@@ -88,5 +88,6 @@
  "now": "now",
  "users": "Users",
  "admin": "Administration",
-  "files": "Files"
+  "files": "Files",
+  "snapshot": "Snapshot"
 }
@@ -73,6 +73,7 @@
    "failed": "Could not attach the file",
    "tooBig": "File too large to upload (max {{mb}} MB) — put it in the workspace folder and attach it from Files",
    "tooBigLocal": "File too large to upload (max {{mb}} MB) — attach it by path instead: + → Choose a file on this computer",
+    "tooBigLocalPaste": "File too large to upload (max {{mb}} MB) — copy it in your file manager and paste it here instead (Ctrl+V): a pasted file goes in by its own path",
    "remove": "Remove attachment",
    "view": "View image"
  },
@@ -884,7 +884,6 @@
    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket",
    "gitHubSub": "ED25519 key — the git@… SSH address",
    "gitHubStepAdd": "Add it to your account on the host: GitHub → Settings → SSH and GPG keys → New SSH key. GitLab: Preferences → SSH Keys. Paste the whole line.",
-    "gitHubStepClone": "Clone with the SSH address the repository page shows:",
    "awsTitle": "AWS CodeCommit",
    "awsSub": "RSA 4096 key — AWS accepts only RSA",
    "stepCopy": "Copy the public key.",
@@ -894,7 +893,6 @@
    "awsRegion": "Region",
    "awsSave": "Save",
    "awsSaved": "SSH key ID saved for {{region}}",
-    "awsReady": "Ready. Clone with the plain address CodeCommit shows — in a terminal or in Add workspace → Clone:",
    "otherTitle": "Other SSH hosts (advanced)",
    "otherHint": "Only for a host that logs you in with a user name other than git. Then a plain ssh://<host>/… address logs in as that user.",
    "otherHost": "Host",
@@ -1035,6 +1033,10 @@
        "title": "Claude Code",
        "description": "Claude Code's own configuration, and what AgentHub reads from it."
      },
+      "claudeCodeOwn": {
+        "title": "Your Claude Code config",
+        "description": "The skills, agents, plugins, MCP servers and settings your own sessions use."
+      },
      "codex": {
        "title": "Codex",
        "description": "Codex's own configuration, and what AgentHub reads from it."
@@ -1142,7 +1144,7 @@
  },
  "nativePaste": {
    "label": "Paste images natively",
-    "description": "On this machine, an image pasted into a Claude pane is read by Claude from your clipboard, like in a normal terminal — nothing is uploaded. Turn it off if you open the dashboard through an SSH tunnel: Claude would read the server's clipboard. This browser only."
+    "description": "On this machine, an image pasted into a Claude pane is read by Claude from your clipboard, like in a normal terminal — nothing is uploaded. Needs wl-paste or xclip on Linux; without them the image is uploaded instead. Turn it off if you open the dashboard through an SSH tunnel: Claude would read the server's clipboard. This browser only."
  },
  "terminalFont": {
    "title": "Terminal font",
@@ -36,7 +36,6 @@
  "autoFixHint": "Open a Claude Code session in the install folder with this error, so an AI agent fixes it and finishes the update.",
  "autoFixWorkspace": "AgentHub update",
  "autoFixError": "Could not start the Auto fix session",
-  "backgroundNote": "The update keeps running in the background — the page reloads itself when the new version is up.",
  "chipTitle": "Updating to {{version}}…",
  "chipHint": "The update runs in the background — click to show it",
  "pluginStep.marketplace_update": "Step {{index}}/{{total}}: refreshing the marketplace",
@@ -197,5 +197,29 @@
  "unowned.claimed": "Đã nhận về thư viện của bạn",
  "unowned.declined": "Đã bỏ khỏi danh sách của bạn",
  "unowned.assigned": "Đã gán chủ",
-  "unowned.empty": "Không có mục nào chưa có chủ."
+  "unowned.empty": "Không có mục nào chưa có chủ.",
+  "private": "Riêng tư",
+  "privateHint": "Chưa chia sẻ: chỉ bạn (và admin) thấy. Bấm Chia sẻ để đưa lên Hub.",
+  "showMore": "Xem thêm {{count}}",
+  "view.label": "Cách hiển thị",
+  "view.list": "Dạng danh sách",
+  "view.grid": "Dạng lưới",
+  "pack.title": "Bộ {{prefix}}-*",
+  "pack.count": "{{count}} skill",
+  "pack.installAll": "Cài tất cả",
+  "pack.installRest": "Cài {{count}} còn lại",
+  "pack.installTitle": "Cài {{count}} skill của bộ {{prefix}}-*?",
+  "pack.installBody": "Mỗi skill được ghi vào tài khoản của bạn. Skill nào bạn đã có cùng tên thì giữ nguyên:",
+  "pack.installed": "Đã cài {{ok}} · đã có sẵn {{skipped}} · lỗi {{failed}}",
+  "section.unshared": "Chủ chưa chia sẻ",
+  "section.unsharedHint": "Mục riêng tư của người khác — chỉ admin thấy",
+  "update": "Cập nhật",
+  "updateHint": "Người tạo đã sửa skill này từ khi bạn cài",
+  "updateTitle": "Cập nhật “{{title}}”?",
+  "updateBody": "Bản {{name}} của bạn sẽ được thay bằng phiên bản mới nhất. Bản hiện tại được chuyển sang ~/.claude/agenthub-replaced-skills/, không bị xóa.",
+  "updated": "Đã cập nhật {{name}}",
+  "pack.updateN": "Cập nhật {{count}}",
+  "pack.updateTitle": "Cập nhật {{count}} skill của bộ {{prefix}}-*?",
+  "pack.updateBody": "Mỗi bản sẽ được thay bằng phiên bản mới nhất; bản hiện tại được chuyển sang ~/.claude/agenthub-replaced-skills/:",
+  "pack.updated": "Đã cập nhật {{ok}} · lỗi {{failed}}"
 }
@@ -1,6 +1,10 @@
 {
  "title": "Trình khám phá cấu hình Claude",
  "subtitle": "Toàn cảnh thiết lập Claude Code của bạn - plugin, skill, subagent, máy chủ MCP, hook và cài đặt.",
+  "own": {
+    "label": "Cấu hình Claude Code của bạn — {{home}}",
+    "subtitle": "Chỉ thiết lập của tài khoản bạn: mọi thay đổi ở đây chạy dưới tài khoản của bạn và chỉ áp dụng cho các phiên của chính bạn."
+  },
  "refresh": "Làm mới",
  "refreshing": "Đang làm mới…",
  "lastUpdated": "Cập nhật lần cuối {{time}}",
@@ -30,6 +34,7 @@
  },
  "overview": {
    "rootsTitle": "Thư mục gốc",
+    "claudeHome": ".claude của bạn",
    "projectClaudeDir": "Dự án .claude",
    "projectRoot": "Thư mục dự án",
    "claudeJson": "claude.json",
@@ -88,5 +88,6 @@
  "now": "bây giờ",
  "users": "Người dùng",
  "admin": "Quản trị",
-  "files": "Quản lý file"
+  "files": "Quản lý file",
+  "snapshot": "Snapshot"
 }
@@ -73,6 +73,7 @@
    "failed": "Không đính kèm được file",
    "tooBig": "File quá lớn để tải lên (tối đa {{mb}} MB) — hãy đặt file vào thư mục workspace rồi đính kèm từ Files",
    "tooBigLocal": "File quá lớn để tải lên (tối đa {{mb}} MB) — hãy đính kèm bằng đường dẫn: + → Chọn file trên máy này",
+    "tooBigLocalPaste": "File quá lớn để tải lên (tối đa {{mb}} MB) — hãy copy file trong trình quản lý file rồi dán vào đây (Ctrl+V): file được dán sẽ dùng đường dẫn gốc",
    "remove": "Bỏ đính kèm",
    "view": "Xem ảnh"
  },
@@ -872,7 +872,6 @@
    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket",
    "gitHubSub": "Key ED25519 — địa chỉ SSH dạng git@…",
    "gitHubStepAdd": "Thêm vào tài khoản trên host: GitHub → Settings → SSH and GPG keys → New SSH key. GitLab: Preferences → SSH Keys. Dán nguyên dòng.",
-    "gitHubStepClone": "Clone bằng địa chỉ SSH mà trang repository hiển thị:",
    "awsTitle": "AWS CodeCommit",
    "awsSub": "Key RSA 4096 — AWS chỉ nhận RSA",
    "stepCopy": "Copy public key.",
@@ -882,7 +881,6 @@
    "awsRegion": "Region",
    "awsSave": "Lưu",
    "awsSaved": "Đã lưu SSH key ID cho {{region}}",
-    "awsReady": "Sẵn sàng. Clone bằng địa chỉ trơn mà CodeCommit hiển thị — trong terminal hoặc Add workspace → Clone:",
    "otherTitle": "Host SSH khác (nâng cao)",
    "otherHint": "Chỉ dùng cho host đăng nhập bằng tên user khác git. Sau khi lưu, địa chỉ ssh://<host>/… trơn sẽ đăng nhập bằng user đó.",
    "otherHost": "Host",
@@ -1023,6 +1021,10 @@
        "title": "Claude Code",
        "description": "Cấu hình của Claude Code và những gì AgentHub đọc từ đó."
      },
+      "claudeCodeOwn": {
+        "title": "Cấu hình Claude Code của bạn",
+        "description": "Skill, agent, plugin, MCP server và thiết lập mà các phiên của chính bạn dùng."
+      },
      "codex": {
        "title": "Codex",
        "description": "Cấu hình của Codex và những gì AgentHub đọc từ đó."
@@ -1130,7 +1132,7 @@
  },
  "nativePaste": {
    "label": "Dán ảnh kiểu native",
-    "description": "Trên máy này, ảnh dán vào pane Claude được Claude tự đọc từ clipboard, như trong terminal thường — không upload gì. Tắt nếu bạn mở dashboard qua SSH tunnel: khi đó Claude sẽ đọc clipboard của server. Chỉ áp dụng cho trình duyệt này."
+    "description": "Trên máy này, ảnh dán vào pane Claude được Claude tự đọc từ clipboard, như trong terminal thường — không upload gì. Trên Linux cần wl-paste hoặc xclip; thiếu thì ảnh được upload thay thế. Tắt nếu bạn mở dashboard qua SSH tunnel: khi đó Claude sẽ đọc clipboard của server. Chỉ áp dụng cho trình duyệt này."
  },
  "terminalFont": {
    "title": "Font terminal",
@@ -36,7 +36,6 @@
  "autoFixHint": "Mở một phiên Claude Code trong thư mục cài đặt kèm lỗi này, để AI agent sửa và hoàn tất cập nhật.",
  "autoFixWorkspace": "Cập nhật AgentHub",
  "autoFixError": "Không mở được phiên Tự sửa",
-  "backgroundNote": "Bản cập nhật vẫn chạy ngầm — trang sẽ tự tải lại khi phiên bản mới sẵn sàng.",
  "chipTitle": "Đang cập nhật lên {{version}}…",
  "chipHint": "Bản cập nhật đang chạy ngầm — bấm để xem",
  "pluginStep.marketplace_update": "Bước {{index}}/{{total}}: làm mới marketplace",
@@ -717,6 +717,11 @@
 .xterm-viewport::-webkit-scrollbar {
  display: none;
 }
+/* xterm 6 draws its own scrollbar (VS Code's scrollable element) instead of
+   the viewport's native one: the same dead affordance, hidden the same way. */
+.xterm .xterm-scrollable-element > .scrollbar {
+  display: none;
+}

 /* Settings → Appearance → Text size (lib/fontSize.ts) sets the ROOT font size.
   Tailwind's own sizes are rem and follow it; these are the `text-[Npx]`
@@ -49,6 +49,16 @@ describe("artifactView", () => {
    expect(isArtifact("server.js", true)).toBe(false);
  });

+  it("never takes the project's own HTML pages for artifacts", () => {
+    expect(isArtifact("/tmp/out/report.html", true)).toBe(true);
+    expect(isArtifact("/tmp/out/report.html", false)).toBe(false);
+    expect(isArtifact("/repo/index.html", true)).toBe(false);
+    expect(isArtifact("/repo/client/INDEX.HTM", true)).toBe(false);
+    expect(isArtifact("/repo/public/about.html", true)).toBe(false);
+    expect(isArtifact("C:\\repo\\templates\\mail.html", true)).toBe(false);
+    expect(isArtifact("/repo/docs/chart.html", true)).toBe(true);
+  });
+
  it("rebuilds a file's versions from Write, Edit and MultiEdit", () => {
    const msgs = [
      use("1", "Write", { file_path: "/w/a.md", content: "# A\nold line\n" }),
@@ -31,9 +31,9 @@ describe("git targets", () => {
    await api.lanes.gitAction(gitTarget(3, "s-1"), "stage", { paths: ["a"] });
    await api.lanes.git(gitTarget(3, null));
    const urls = spy.mock.calls.map((c) => String(c[0]));
-    expect(urls[0]).toMatch(/\/lanes\/3\/git\/changes\?range=work$/);
-    expect(urls[1]).toMatch(/\/lanes\/3\/git\/changes\?range=work&session=s-1$/);
-    expect(urls[2]).toMatch(/\/lanes\/3\/git\/stage\?session=s-1$/);
-    expect(urls[3]).toMatch(/\/lanes\/3\/git$/);
+    expect(urls[0]).toMatch(/\/workspaces\/3\/git\/changes\?range=work$/);
+    expect(urls[1]).toMatch(/\/workspaces\/3\/git\/changes\?range=work&session=s-1$/);
+    expect(urls[2]).toMatch(/\/workspaces\/3\/git\/stage\?session=s-1$/);
+    expect(urls[3]).toMatch(/\/workspaces\/3\/git$/);
  });
 });
@@ -25,7 +25,7 @@ function stubFetch(body: unknown) {
 }

 describe("api.lanes.git", () => {
-  it("requests /api/lanes/<id>/git and returns the parsed facts", async () => {
+  it("requests /api/workspaces/<id>/git and returns the parsed facts", async () => {
    const facts = {
      available: true,
      branch: "feat/x",
@@ -41,7 +41,7 @@ describe("api.lanes.git", () => {
    expect(spy).toHaveBeenCalledTimes(1);
    const call = spy.mock.calls[0] as [string, RequestInit | undefined];
    // endsWith, not toContain: `/gitt` contains `/git` and would slip through.
-    expect(String(call[0]).endsWith("/api/lanes/3/git")).toBe(true);
+    expect(String(call[0]).endsWith("/api/workspaces/3/git")).toBe(true);
    expect(call[1]?.method ?? "GET").toBe("GET");
    expect(result).toEqual(facts);
  });
@@ -915,7 +915,7 @@ function gitUrl(target: GitTarget, sub: string, q?: URLSearchParams): string {
  if (typeof target !== "number" && target.source) params.set("source", String(target.source));
  if (typeof target !== "number" && target.repo) params.set("repo", target.repo);
  const qs = params.toString();
-  return `/lanes/${lane}/git${sub}${qs ? `?${qs}` : ""}`;
+  return `/workspaces/${lane}/git${sub}${qs ? `?${qs}` : ""}`;
 }

 /** Where the File Explorer works: a workspace (as {@link GitTarget}) or a user's home. */
@@ -929,7 +929,7 @@ function fsUrl(place: FsPlace, sub: string, q?: URLSearchParams): string {
    const qs = new URLSearchParams(q).toString();
    return `/homes/${encodeURIComponent(place.home)}/fs${sub}${qs ? `?${qs}` : ""}`;
  }
-  return gitUrl(place, sub, q).replace(/^(\/lanes\/\d+)\/git/, "$1/fs");
+  return gitUrl(place, sub, q).replace(/^(\/workspaces\/\d+)\/git/, "$1/fs");
 }

 /**
@@ -1023,6 +1023,13 @@ export function gitTarget(
  return session ? { lane: laneId, session } : laneId;
 }

+/** A file the dashboard machine's file manager holds, by its own path. */
+export interface FileManagerFile {
+  path: string;
+  size: number | null;
+  dir: boolean;
+}
+
 export const api = {
  // ───────────────────────── Server mode login (routes/auth.js) ─────────────────────────
  auth: {
@@ -2003,7 +2010,7 @@ export const api = {
        purged_agents: number;
      }>("/settings/cleanup", { method: "POST", body: JSON.stringify(params) }),
    gc: (body: { dryRun?: boolean } = {}) =>
-      request<{ reaped: number[]; capped: { path: string; sizeBefore: number }[] }>("/lanes/gc", {
+      request<{ reaped: number[]; capped: { path: string; sizeBefore: number }[] }>("/workspaces/gc", {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -2152,7 +2159,9 @@ export const api = {
     *
     * @returns {@link CostResult} — the aggregate cost breakdown across sessions.
     */
-    totalCost: (opts: { lane?: number; date?: string; tool?: string; range?: DateRange } = {}) => {
+    totalCost: (
+      opts: { lane?: number; date?: string; tool?: string; range?: DateRange; mine?: boolean } = {}
+    ) => {
      // Scope the aggregate to the active data-scope, exactly like the sessions /
      // stats / analytics endpoints — otherwise switching the Data scope selector
      // left the Dashboard "total cost" showing the un-narrowed global total.
@@ -2162,6 +2171,8 @@ export const api = {
      // `date` (local YYYY-MM-DD): only that day's usage, breakdown included.
      if (opts.date) qs.set("date", opts.date);
      if (opts.tool) qs.set("tool", opts.tool);
+      // `mine`: only the caller's own sessions, even for an admin/analyst (server mode).
+      if (opts.mine) qs.set("mine", "1");
      // `range`: total, breakdown and by_tool for those local days only.
      applyRange(qs, opts.range);
      applyScope(qs);
@@ -2286,6 +2297,13 @@ export const api = {
   *  CLAUDE.md/auto-memory, marketplaces, keybindings, and the statusline
   *  script - for the dashboard's "CC Config" explorer/editor pages. */
  ccConfig: {
+    /**
+     * GET /api/cc-config/target - whose Claude Code config this login manages
+     * here: `own` (server mode, their own account's), `host` (an admin, local
+     * mode, or an analyst's read-only view), `none` (no account: the page is
+     * not theirs).
+     */
+    target: () => request<CcTarget>("/cc-config/target"),
    /**
     * GET /api/cc-config/overview - counts of every artifact kind, for the
     * explorer's landing page.
@@ -3143,6 +3161,13 @@ export const api = {
        method: "POST",
        body: JSON.stringify({ replace }),
      }),
+    /** POST /api/artifacts/:id/install `{update: true}` — an installed skill's
+     *  copies replaced by its newest version (the old ones moved aside). */
+    updateInstalled: (id: number) =>
+      request<{ installed: string; replaced?: boolean }>(`/artifacts/${id}/install`, {
+        method: "POST",
+        body: JSON.stringify({ update: true }),
+      }),
    /** POST /api/artifacts/:id/uninstall — a skill moved aside, a plugin `claude plugin uninstall`. */
    uninstall: (id: number) =>
      request<{ uninstalled: string; paths: string[] }>(`/artifacts/${id}/uninstall`, {
@@ -3343,6 +3368,27 @@ export const api = {
        method: "POST",
        body: JSON.stringify({ paths }),
      }),
+    /** POST /api/run/clipboard-files — the files a file manager's Copy put on
+     *  the dashboard machine's clipboard, by their own paths (`size` null for a
+     *  folder); 403 EREMOTE unless local mode and a loopback browser. */
+    clipboardFiles: () =>
+      request<{ files: FileManagerFile[] }>("/run/clipboard-files", {
+        method: "POST",
+        body: "{}",
+      }),
+    /** POST /api/run/selected-files — the files selected in that machine's
+     *  file manager (Explorer, Finder): what a drag from it carries. Same
+     *  shape and refusal as `clipboardFiles`. */
+    selectedFiles: () =>
+      request<{ files: FileManagerFile[] }>("/run/selected-files", {
+        method: "POST",
+        body: "{}",
+      }),
+    /** GET /api/run/native-paste — whether a `claude` pane can read this
+     *  machine's clipboard itself (a reader installed, a display reachable);
+     *  false for a remote browser and in server mode. `key`: the chord
+     *  `claude` reads an image with on that machine (Alt+V on Windows). */
+    nativePaste: () => request<{ native: boolean; key?: "ctrl+v" | "alt+v" }>("/run/native-paste"),
    /** POST /api/run - start (or adopt, if already live) a lane's terminal run. */
    start: (args: RunStartArgs) =>
      request<RunHandle>("/run", { method: "POST", body: JSON.stringify(args) }),
@@ -3751,7 +3797,7 @@ export const api = {
     * GET /api/lanes — list all lanes with pipeline progress and liveness.
     * @returns `{ lanes, counts }` — all {@link Lane} records and aggregate counts.
     */
-    list: () => request<{ lanes: Lane[]; counts: LaneCounts }>("/lanes"),
+    list: () => request<{ lanes: Lane[]; counts: LaneCounts }>("/workspaces"),
    /**
     * POST /api/lanes/ensure — ensure a lane exists for the given cwd.
     * @param body The cwd and optional title. When `cwd` is omitted the server
@@ -3767,7 +3813,7 @@ export const api = {
      /** Only a lane on THIS directory counts, not one on a parent of it. */
      exact?: boolean;
    }) =>
-      request<{ lane: Lane; created: boolean }>("/lanes/ensure", {
+      request<{ lane: Lane; created: boolean }>("/workspaces/ensure", {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -3790,7 +3836,7 @@ export const api = {
      /** This clone's name for {@link lanes.cloneProgress}. */
      progressToken?: string;
    }) =>
-      request<{ lane: Lane; created: boolean; path: string }>("/lanes/clone", {
+      request<{ lane: Lane; created: boolean; path: string }>("/workspaces/clone", {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -3800,7 +3846,7 @@ export const api = {
     * carrying `progressToken` arrives, and a minute after it ends.
     */
    cloneProgress: (token: string) =>
-      request<CloneProgressView>(`/lanes/clone/progress/${encodeURIComponent(token)}`),
+      request<CloneProgressView>(`/workspaces/clone/progress/${encodeURIComponent(token)}`),
    /**
     * GET /api/lanes/pipelines — every pipeline template the server can render
     * a lane against, built-in plus any `DASHBOARD_PIPELINES_DIR` override.
@@ -3808,7 +3854,7 @@ export const api = {
     */
    pipelines: () =>
      request<{ pipelines: { id: string; name: string; nodes: { id: string }[] }[] }>(
-        "/lanes/pipelines"
+        "/workspaces/pipelines"
      ),
    /**
     * GET /api/lanes/pipeline-stats — per-node pass counts aggregated over every
@@ -3818,7 +3864,7 @@ export const api = {
     */
    pipelineStats: (laneId?: number | null) =>
      request<PipelineStats>(
-        `/lanes/pipeline-stats${laneId ? `?lane=${encodeURIComponent(laneId)}` : ""}`
+        `/workspaces/pipeline-stats${laneId ? `?lane=${encodeURIComponent(laneId)}` : ""}`
      ),
    /**
     * GET /api/lanes/branches — a candidate source repo's local branches.
@@ -3830,7 +3876,7 @@ export const api = {
     */
    branches: (repo: string) =>
      request<{ branches: string[]; current: string | null; worktrees: LaneWorktree[] }>(
-        `/lanes/branches?repo=${encodeURIComponent(repo)}`
+        `/workspaces/branches?repo=${encodeURIComponent(repo)}`
      ),
    /**
     * POST /api/lanes/worktree — provision a dashboard-managed git worktree as
@@ -3848,7 +3894,7 @@ export const api = {
      pipeline?: string;
      tool?: LaneTool;
    }) =>
-      request<{ lane: Lane }>("/lanes/worktree", {
+      request<{ lane: Lane }>("/workspaces/worktree", {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -3883,7 +3929,7 @@ export const api = {
          file?: boolean;
          mtime?: number | null;
        }[];
-      }>(`/lanes/browse${qs ? `?${qs}` : ""}`);
+      }>(`/workspaces/browse${qs ? `?${qs}` : ""}`);
    },
    /**
     * POST /api/lanes/browse/mkdir — the folder browser's New folder: one
@@ -3891,7 +3937,7 @@ export const api = {
     * `EFOLDER` (outside the caller's own folder).
     */
    mkdir: (parent: string, name: string) =>
-      request<{ path: string }>("/lanes/browse/mkdir", {
+      request<{ path: string }>("/workspaces/browse/mkdir", {
        method: "POST",
        body: JSON.stringify({ parent, name }),
      }),
@@ -3905,7 +3951,7 @@ export const api = {
     * @returns `{ path }`, or `{ cancelled: true }` when the user cancelled.
     */
    pickPath: (kind: "dir" | "file", start?: string) =>
-      request<{ path?: string; cancelled?: boolean }>("/lanes/pick-path", {
+      request<{ path?: string; cancelled?: boolean }>("/workspaces/pick-path", {
        method: "POST",
        body: JSON.stringify({ kind, start }),
      }),
@@ -3914,7 +3960,7 @@ export const api = {
     * @param id The lane id.
     * @returns `{ lane }` — the {@link Lane} record.
     */
-    get: (id: number) => request<{ lane: Lane }>(`/lanes/${id}`),
+    get: (id: number) => request<{ lane: Lane }>(`/workspaces/${id}`),
    /**
     * GET /api/lanes/:id/git — the lane's working-copy facts.
     * @param id The lane id.
@@ -4048,7 +4094,7 @@ export const api = {
     */
    removeSessionWorktree: (id: number, session: string) =>
      request<{ removed: true; branch: string | null; branchKept: boolean }>(
-        `/lanes/${id}/session-worktree/remove`,
+        `/workspaces/${id}/session-worktree/remove`,
        { method: "POST", body: JSON.stringify({ session, confirm: true }) }
      ),
    gitBranches: (id: GitTarget) =>
@@ -4142,7 +4188,7 @@ export const api = {
     * @param id The lane id.
     * @returns {@link LaneRuntime}
     */
-    runtime: (id: number) => request<LaneRuntime>(`/lanes/${id}/runtime`),
+    runtime: (id: number) => request<LaneRuntime>(`/workspaces/${id}/runtime`),
    /**
     * POST /api/lanes/:id/up — boot the lane's stack through its profile hooks.
     * Returns 202: the boot runs in the background and streams progress as
@@ -4151,7 +4197,7 @@ export const api = {
     * @param body `build: false` reuses an existing build.
     */
    up: (id: number, body: { build?: boolean } = {}) =>
-      request<{ ok: true; laneId: number }>(`/lanes/${id}/up`, {
+      request<{ ok: true; laneId: number }>(`/workspaces/${id}/up`, {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -4162,7 +4208,7 @@ export const api = {
     * @returns The pids stopped and the resulting runtime facts.
     */
    down: (id: number) =>
-      request<{ ok: true; killed: number[]; runtime: LaneRuntime }>(`/lanes/${id}/down`, {
+      request<{ ok: true; killed: number[]; runtime: LaneRuntime }>(`/workspaces/${id}/down`, {
        method: "POST",
        body: JSON.stringify({}),
      }),
@@ -4172,7 +4218,7 @@ export const api = {
     * @returns `{ lane }` — the created {@link Lane}.
     */
    create: (body: { title?: string; cwd: string; branch?: string; pipeline?: string }) =>
-      request<{ lane: Lane }>("/lanes", { method: "POST", body: JSON.stringify(body) }),
+      request<{ lane: Lane }>("/workspaces", { method: "POST", body: JSON.stringify(body) }),
    /**
     * PATCH /api/lanes/:id — partial update of a lane.
     * @param id   The lane id.
@@ -4181,17 +4227,17 @@ export const api = {
     */
    /** GET /api/lanes/:id/sources — the workspace's instructions, extra
     *  folders and context files, and whether its tool can take them. */
-    sources: (id: number) => request<LaneSourcesView>(`/lanes/${id}/sources`),
+    sources: (id: number) => request<LaneSourcesView>(`/workspaces/${id}/sources`),
    /** GET /api/lanes/:id/repos — the git repos inside the workspace folder
     *  (a parent folder of several repos), each a Changes section read with
     *  `?repo=<path>`; `root` = the folder itself is in a repo. */
    repos: (id: number, refresh = false) =>
      request<{ root: boolean; items: { path: string; name: string }[]; truncated: boolean }>(
-        `/lanes/${id}/repos${refresh ? "?refresh=1" : ""}`
+        `/workspaces/${id}/repos${refresh ? "?refresh=1" : ""}`
      ),
    /** PUT /api/lanes/:id/instructions — appended to every new pane's system prompt. */
    setInstructions: (id: number, instructions: string | null) =>
-      request<LaneSourcesView>(`/lanes/${id}/instructions`, {
+      request<LaneSourcesView>(`/workspaces/${id}/instructions`, {
        method: "PUT",
        body: JSON.stringify({ instructions }),
      }),
@@ -4209,19 +4255,19 @@ export const api = {
        progressToken?: string;
      }
    ) =>
-      request<LaneSourcesView & { path: string }>(`/lanes/${id}/sources/clone`, {
+      request<LaneSourcesView & { path: string }>(`/workspaces/${id}/sources/clone`, {
        method: "POST",
        body: JSON.stringify(body),
      }),
    /** POST /api/lanes/:id/sources/folder — an extra folder the agent may use. */
    addFolder: (id: number, path: string) =>
-      request<LaneSourcesView>(`/lanes/${id}/sources/folder`, {
+      request<LaneSourcesView>(`/workspaces/${id}/sources/folder`, {
        method: "POST",
        body: JSON.stringify({ path }),
      }),
    /** POST /api/lanes/:id/sources/file — upload one context file (≤ 10 MB). */
    addFile: (id: number, file: File) =>
-      request<LaneSourcesView>(`/lanes/${id}/sources/file`, {
+      request<LaneSourcesView>(`/workspaces/${id}/sources/file`, {
        method: "POST",
        body: file,
        headers: {
@@ -4232,11 +4278,11 @@ export const api = {
    /** DELETE /api/lanes/:id/sources/:sourceId — a folder stays on disk; an
     *  uploaded file's AgentHub copy is deleted. */
    removeSource: (id: number, sourceId: number) =>
-      request<LaneSourcesView>(`/lanes/${id}/sources/${sourceId}`, { method: "DELETE" }),
+      request<LaneSourcesView>(`/workspaces/${id}/sources/${sourceId}`, { method: "DELETE" }),
    /** GET /api/lanes/:id/memory — CLAUDE.md/AGENTS.md and Claude's auto memory, read-only. */
-    memory: (id: number) => request<{ files: LaneMemoryFile[] }>(`/lanes/${id}/memory`),
+    memory: (id: number) => request<{ files: LaneMemoryFile[] }>(`/workspaces/${id}/memory`),
    update: (id: number, patch: Partial<Lane>) =>
-      request<{ lane: Lane }>(`/lanes/${id}`, { method: "PATCH", body: JSON.stringify(patch) }),
+      request<{ lane: Lane }>(`/workspaces/${id}`, { method: "PATCH", body: JSON.stringify(patch) }),
    /**
     * POST /api/lanes/:id/stage — advance the pipeline stage.
     * @param id   The lane id.
@@ -4247,14 +4293,14 @@ export const api = {
      id: number,
      body: { stage: string; status?: string; evidence?: string; note?: string; result?: string }
    ) =>
-      request<{ lane: Lane }>(`/lanes/${id}/stage`, { method: "POST", body: JSON.stringify(body) }),
+      request<{ lane: Lane }>(`/workspaces/${id}/stage`, { method: "POST", body: JSON.stringify(body) }),
    /**
     * GET /api/lanes/:id/preflight?action=reset|remove|purge — read the
     * action-specific facts that a destructive request must echo as `expect`.
     */
    preflight: (id: number, action: "reset" | "remove" | "purge") =>
      request<import("./types").LanePreflight>(
-        `/lanes/${id}/preflight?${new URLSearchParams({ action }).toString()}`
+        `/workspaces/${id}/preflight?${new URLSearchParams({ action }).toString()}`
      ),
    /**
     * POST /api/lanes/:id/:action — trigger a lane action (start, stop, clear, remove, etc.).
@@ -4266,7 +4312,7 @@ export const api = {
    action: (id: number, action: string, body: Record<string, unknown> = {}) =>
      // `run_id` answers a `start`: the session it opened, which for a split
      // pane's slot (`body.slot` 1–3) is not the lane's own `run_id`.
-      request<{ lane?: Lane; ok?: boolean; run_id?: string }>(`/lanes/${id}/${action}`, {
+      request<{ lane?: Lane; ok?: boolean; run_id?: string }>(`/workspaces/${id}/${action}`, {
        method: "POST",
        body: JSON.stringify(body),
      }),
@@ -4277,7 +4323,7 @@ export const api = {
     */
    features: {
      list: (id: number) =>
-        request<{ features: import("./types").LaneFeature[] }>(`/lanes/${id}/features`),
+        request<{ features: import("./types").LaneFeature[] }>(`/workspaces/${id}/features`),
      /**
       * GET /api/lanes/:id/features/:slug — fetch an archived feature snapshot.
       * @param id The lane id.
@@ -4286,7 +4332,7 @@ export const api = {
       */
      show: (id: number, slug: string) =>
        request<{ feature: import("./types").LaneFeature }>(
-          `/lanes/${id}/features/${encodeURIComponent(slug)}`
+          `/workspaces/${id}/features/${encodeURIComponent(slug)}`
        ),
    },
    /**
@@ -4296,7 +4342,7 @@ export const api = {
     */
    proof: {
      list: (id: number) =>
-        request<{ features: import("./types").ProofFeature[] }>(`/lanes/${id}/proof`),
+        request<{ features: import("./types").ProofFeature[] }>(`/workspaces/${id}/proof`),
      /**
       * URL for a proof image, ready to use in an <img src>.
       * @param id The lane id.
@@ -4306,7 +4352,7 @@ export const api = {
       * @returns A URL string pointing to the image.
       */
      imageUrl: (id: number, slug: string, group: string, file: string): string =>
-        `/api/lanes/${id}/proof/${encodeURIComponent(slug)}/${encodeURIComponent(group)}/${encodeURIComponent(file)}`,
+        `/api/workspaces/${id}/proof/${encodeURIComponent(slug)}/${encodeURIComponent(group)}/${encodeURIComponent(file)}`,
      /**
       * DELETE /api/lanes/:id/proof/:slug — delete proof entries for a feature.
       * @param id The lane id.
@@ -4315,19 +4361,19 @@ export const api = {
       * @returns `{ deleted }` — count of deleted images.
       */
      delete: (id: number, slug: string, body: { group?: string; images?: string[] }) =>
-        request<{ deleted: number }>(`/lanes/${id}/proof/${encodeURIComponent(slug)}`, {
+        request<{ deleted: number }>(`/workspaces/${id}/proof/${encodeURIComponent(slug)}`, {
          method: "DELETE",
          body: JSON.stringify(body),
        }),
    },
    mcpSync: (id: number) =>
-      request<{ servers: string[]; profilesSeeded: string[] }>(`/lanes/${id}/mcp/sync`, {
+      request<{ servers: string[]; profilesSeeded: string[] }>(`/workspaces/${id}/mcp/sync`, {
        method: "POST",
        body: "{}",
      }),
    profileInit: (id: number, force = false) =>
      request<{ scaffolded: boolean; written?: string[]; todos?: string[]; reason?: string }>(
-        `/lanes/${id}/profile/init`,
+        `/workspaces/${id}/profile/init`,
        { method: "POST", body: JSON.stringify({ force }) }
      ),
  },
@@ -4423,6 +4469,9 @@ export interface Artifact {
  inLibrary: boolean;
  /** List rows only: a skill/plugin already in every account the viewer's sessions run as. */
  installed?: boolean;
+  /** List rows only: an installed skill whose copy differs from its newest
+   *  version (its owner changed it since) — the list offers Update. */
+  updateAvailable?: boolean;
  /** file: captured when its session stopped, not pinned by hand. */
  auto?: boolean;
  /** Server mode: nobody owns it yet. */
@@ -4585,6 +4634,13 @@ export interface CcProfileUsage {
 *  user + project scope in one response. */
 export type CcScope = "user" | "project" | "all";

+/** GET /api/cc-config/target — whose Claude Code config the page manages. */
+export interface CcTarget {
+  kind: "own" | "host" | "none";
+  readOnly: boolean;
+  claudeHome: string | null;
+}
+
 /** The per-tier model names an AI Proxy profile carries. Each maps to one env
 *  var Claude Code reads; a proxy that names its models once fills them all
 *  from the profile's `model`. */
@@ -5165,8 +5221,9 @@ export interface CcOverview {
  /** Key filesystem locations the explorer reads from. */
  roots: {
    claudeHome: string;
-    projectClaudeDir: string;
-    projectRoot: string;
+    /** Null for a member's own config with no workspace named: no project layer. */
+    projectClaudeDir: string | null;
+    projectRoot: string | null;
    /** Path to the top-level `.claude.json` (marketplaces/global settings). */
    claudeJson: string;
  };
@@ -43,13 +43,40 @@ export const RENDERED: ReadonlySet<ArtifactKind> = new Set([
  "image",
 ]);

-/** An edit worth a card in the conversation: a page, a document, a diagram, a
- *  table — and a React component the model wrote whole (a `.tsx` it merely
- *  edited is project code, not an artifact). */
+/** Folders an app keeps its own pages in: an HTML file under one of them is
+ *  the project's code, never a page the model made to show. */
+const PROJECT_DIRS = new Set([
+  "src",
+  "public",
+  "templates",
+  "views",
+  "pages",
+  "app",
+  "static",
+  "dist",
+  "build",
+  "components",
+  "layouts",
+]);
+
+/** An HTML file the project serves itself: an `index.html`, or one under a
+ *  folder in {@link PROJECT_DIRS}. */
+function isProjectPage(path: string): boolean {
+  const parts = path.split(/[\\/]/);
+  const name = (parts.pop() || "").toLowerCase();
+  if (name === "index.html" || name === "index.htm") return true;
+  return parts.some((d) => PROJECT_DIRS.has(d.toLowerCase()));
+}
+
+/** An edit worth a card in the conversation: a document, a diagram, a table —
+ *  and a page or React component the model wrote whole (a `.tsx` or `.html` it
+ *  merely edited, and an HTML page of the project itself, are project code,
+ *  not an artifact). */
 export function isArtifact(path: string, created: boolean): boolean {
  const k = artifactKind(path);
  if (k === "react") return created;
-  return k === "html" || k === "svg" || k === "markdown" || k === "mermaid" || k === "csv";
+  if (k === "html") return created && !isProjectPage(path);
+  return k === "svg" || k === "markdown" || k === "mermaid" || k === "csv";
 }

 /** A code fence language for the Code tab. */
@@ -7,7 +7,7 @@
 *
 * The order lives in the browser rather than the lanes table on purpose: it is
 * a per-viewer preference, and nothing
- * server-side (the CLI's `agenthub lanes`, the pipeline-stats picker) has an
+ * server-side (the CLI's `agenthub workspaces`, the pipeline-stats picker) has an
 * opinion about it. Ceiling: the order does not follow the user to another
 * browser or to the CLI — move it to a `lanes.sort_order` column if it ever
 * must.
@@ -8,9 +8,15 @@
 * uploaded or copied. Off, the image is uploaded like a remote browser's. An
 * SSH tunnel's browser also reaches the dashboard by loopback, and its `^V`
 * would read the SERVER's clipboard — that is what turning it off is for.
+ * The server must also be able to read its clipboard (`nativePasteWorks`: on
+ * Linux `wl-paste`/`xclip` and a display) — else the `^V` pasted nothing.
+ * On Windows Claude Code binds its image paste to Alt+V, not Ctrl+V
+ * (`nativePasteKey`): a `^V` there was silently ignored.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

+import { api } from "./api";
+
 export const NATIVE_PASTE_KEY = "agenthub.terminal.nativePaste";

 /** True unless this browser turned native image paste off. */
@@ -30,3 +36,36 @@ export function writeNativePaste(on: boolean) {
    /* storage blocked — the default */
  }
 }
+
+let works: boolean | null = null;
+let asked: Promise<void> | null = null;
+// Claude Code's image-paste chord on the dashboard's machine: Ctrl+V, but
+// Alt+V on Windows, where a ^V reaches no binding and pastes nothing.
+let key = "\x16";
+
+/** Whether the dashboard's machine can hand a pane its clipboard, as last
+ *  answered — false until it has (an upload then, which always works). The
+ *  first call asks the server once per page. */
+export function nativePasteWorks(): boolean {
+  asked ??= api.run
+    .nativePaste()
+    .then((r) => {
+      works = r.native === true;
+      key = r.key === "alt+v" ? "\x1bv" : "\x16";
+    })
+    .catch(() => void (works = false));
+  return works === true;
+}
+
+/** The bytes that make the pane's `claude` read its clipboard: ^V, or ESC v
+ *  (Alt+V) on a Windows dashboard. */
+export function nativePasteKey(): string {
+  return key;
+}
+
+/** Test seam: forget the server's answer. */
+export function __resetNativePaste() {
+  works = null;
+  asked = null;
+  key = "\x16";
+}
@@ -9,8 +9,10 @@
 * dashboard's own machine attaches by path instead of uploading
 * (`localCandidates` — a drag's uri-list, or the plain-text paths a pasted
 * file-manager copy carries —, checked by the server in `sameFilesHere` —
- * `POST /api/run/local-paths` —, `localAttachment`). An attachment is a path
- * sent with the prompt; that check is the one call here to the server.
+ * `POST /api/run/local-paths` —, `localAttachment`), and the pasted or
+ * dropped files that machine's file manager holds (`fileManagerPaths`). An
+ * attachment is a path sent with the prompt; those checks are the calls here
+ * to the server.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -144,6 +146,53 @@ export async function sameFilesHere(paths: string[], files: File[]): Promise<boo
  }
 }

+/** A pasted BITMAP (a screenshot), not a copied image FILE: browsers name the
+ *  clipboard's picture `image.png`, while a file manager's copy keeps its own
+ *  name. Only a bitmap goes to `claude`'s own image paste — a copied file is
+ *  pasted by its path, as a native terminal does (`claude` finds no picture
+ *  on a clipboard that holds a file) — and a bitmap that comes WITH text (a
+ *  spreadsheet's cells, a page's selection) is the text's picture: a
+ *  terminal pastes the text. */
+export function isClipboardBitmap(f: File): boolean {
+  return f.type.startsWith("image/") && f.name === "image.png";
+}
+
+/** The pasted or dropped `files` by their own paths on the dashboard's
+ *  machine, as its file manager holds them — a paste on its OS clipboard, a
+ *  drop as its selection, which is what a drag from it carries
+ *  (`POST /api/run/clipboard-files` / `selected-files`): a native terminal's
+ *  paths, and the one way past the upload limit. Null when this is not a
+ *  loopback browser, on a refusal (server mode), or when any file is not
+ *  held under the same name and size (an SSH tunnel's browser pastes
+ *  ANOTHER machine's files). Paths come back in `files`' order. */
+export async function fileManagerPaths(
+  files: File[],
+  from: "paste" | "drop"
+): Promise<string[] | null> {
+  if (!isLocalBrowser() || files.length === 0) return null;
+  try {
+    const { files: held } = await (from === "paste"
+      ? api.run.clipboardFiles()
+      : api.run.selectedFiles());
+    const base = (p: string) =>
+      p
+        .replace(/[\\/]+$/, "")
+        .split(/[\\/]/)
+        .pop() ?? "";
+    const left = [...held];
+    const paths: string[] = [];
+    for (const f of files) {
+      const i = left.findIndex((h) => base(h.path) === f.name && (h.dir || h.size === f.size));
+      if (i < 0) return null;
+      paths.push(left[i]!.path.replace(/(.)[\\/]+$/, "$1"));
+      left.splice(i, 1);
+    }
+    return paths;
+  } catch {
+    return null;
+  }
+}
+
 /** The local files a drop or a paste names as `file://` URIs (a file
 *  manager's, an editor's), as absolute paths — or null when it names none,
 *  or anything that is not one. `file:///C:/x` is `C:/x`. */
@@ -169,9 +218,11 @@ export function droppedFilePaths(dt: DataTransfer | null | undefined): string[]

 /** A file on this machine, by its absolute path, as an attachment. */
 export function localAttachment(path: string): Attachment {
+  // A Windows path in `/` form, like `claudeMention` (Windows takes either).
+  const p = /^[A-Za-z]:\\/.test(path) ? path.replace(/\\/g, "/") : path;
  return {
    // A space would end the mention: Claude Code reads `@"…"` whole.
-    path: /\s/.test(path) ? `@"${path}"` : `@${path}`,
+    path: /\s/.test(p) ? `@"${p}"` : `@${p}`,
    name:
      path
        .replace(/[\\/]$/, "")
@@ -732,10 +732,9 @@ export interface Session {
  /** The AI coding CLI that produced the session: `"claude"` (the default —
   * Claude Code's hooks and imported transcripts), `"codex"` (Codex's rollout
   * journals and hooks), `"antigravity"` (agy's conversation files and
-   * hooks), `"cursor"` (Cursor's agent transcripts, no tokens), `"omp"`,
-   * `"opencode"` (their own session stores, with tokens and subagents) or
-   * `"grok"` (Grok running the Claude hooks, no tokens). Maps to
-   * `sessions.tool`. */
+   * hooks), `"cursor"` (Cursor's agent transcripts, no tokens) or `"omp"`
+   * (its own session journals, with tokens and subagents). Rows an older build
+   * wrote may still say `"opencode"` or `"grok"`. Maps to `sessions.tool`. */
  tool?: string;
  /** The workspace (lane id) that owns the session — the one whose pane held
   * it; null for a session no workspace started.
@@ -1217,7 +1216,7 @@ export interface CostResult {

 /** GET /api/pricing/quota: plan quota spent per native tool (server/lib/quota.js). */
 export interface ToolQuota {
-  id: "claude" | "codex" | "antigravity" | "cursor" | "grok" | "kimi" | "opencode";
+  id: "claude" | "codex" | "antigravity" | "cursor";
  /** One per plan window: `5h`, `wk`, `mo`, …; `usedPercent` is 0–100.
   *  `group` names the model pool a window belongs to (Antigravity's). */
  windows: Array<{
@@ -2634,7 +2633,7 @@ export interface LaneNode {
  icon: string;
  gate: boolean;
  /** The one command that drives this node — a slash command
-   *  (`/superpowers:writing-plans`) or a shell one (`agenthub lanes hook ci-gate`),
+   *  (`/superpowers:writing-plans`) or a shell one (`agenthub workspace hook ci-gate`),
   *  from the pipeline template. Empty string for a node with no single driver
   *  (`done`, or a gate another agent declares). Display text only; the
   *  dashboard never runs it. Optional in the type only because the archived
@@ -3236,6 +3235,10 @@ export interface TranscriptContent {
  /** Present on a Write/Edit/MultiEdit "tool_result": the lines it added and
   *  removed (from Claude Code's `structuredPatch`). */
  diff?: { added: number; removed: number };
+  /** Present on an Agent/Task "tool_result" whose subagent (or one it started)
+   *  wrote or edited files: each file with its +/- lines (`counted`: the
+   *  results carried them). Read from the subagent's own transcript. */
+  edits?: { path: string; added: number; removed: number; counted: boolean }[];
  /** Present on an AskUserQuestion "tool_result": question text → the option
   *  the user picked, or what they typed. */
  answers?: Record<string, string>;
@@ -3320,6 +3323,10 @@ export interface TranscriptResult {
  last_line: number;
  /** JSONL line number of the first message in this page. */
  first_line: number;
+  /** Claude only, when the page starts in the middle of a turn: the files
+   *  that turn changed before the page's first message — the chat adds them
+   *  to the turn's "Edited N files" card. */
+  turn_edits?: { path: string; added: number; removed: number; counted: boolean }[];
 }

 /** One entry in a session's transcript picker (main agent, a subagent, or a
@@ -1,6 +1,6 @@
 /**
 * @file main.tsx
- * @description Vite client entry point. Bootstraps React 18, loads global styles,
+ * @description Vite client entry point. Bootstraps React 19, loads global styles,
 * registers the service worker, prefetches the Workspace chunk on a `/workspace`
 * deep link, and mounts {@link App} into `#root` once the active locale is loaded.
 *
@@ -16,6 +16,11 @@
 * files, and the `MdItemList` artifacts) also opens a
 * right-click menu that repeats those buttons — same handlers, same
 * confirm path — plus Copy name/path.
+ * Server mode, a non-admin with their own Linux account (S3): the page is
+ * THEIR config (`useCcTarget`, labelled as such, no project layer unless a
+ * workspace is named), and the host-wide controls — Switch profile, Update
+ * all, AgentHub's own Claude settings — are an admin's and hidden (the server
+ * refuses them anyway).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 /* =============================================================================
@@ -126,6 +131,8 @@ import { ScopeBadge } from "../components/config/ScopeBadge";
 import { ConfigTabBar } from "../components/config/ConfigTabBar";
 import { ProjectMemoryModal } from "../components/config/ProjectMemoryModal";
 import { ClaudeAgentHubSettings } from "../components/settings/ClaudeAgentHubSettings";
+import { usePermissions } from "../components/AuthGate";
+import { useCcTarget } from "../hooks/useCcTarget";
 import {
  Empty,
  SkeletonRows,
@@ -516,8 +523,14 @@ export function CcConfig() {

  const wsConnected = useSyncExternalStore(eventBus.onConnection, () => eventBus.connected);
  const projectRoot = data.overview?.roots.projectRoot ?? null;
-  // Project files under the plugin cache are wiped by the next plugin update.
-  const projectDisabled = isPluginCachePath(projectRoot);
+  // Server mode: whose config this is. The host-wide controls are an admin's.
+  const { isAdmin } = usePermissions();
+  const ccTarget = useCcTarget();
+  const ownHome = ccTarget?.kind === "own" ? ccTarget.claudeHome : null;
+  // Project files under the plugin cache are wiped by the next plugin update;
+  // a member's own config has no project layer at all.
+  const projectDisabled =
+    isPluginCachePath(projectRoot) || (!!data.overview && projectRoot === null);
  useEffect(() => {
    if (projectDisabled && scope === "project") setScope("all");
  }, [projectDisabled, scope]);
@@ -681,6 +694,8 @@ export function CcConfig() {
        }}
        onOpenBackups={() => setBackupsOpen(true)}
        wsConnected={wsConnected}
+        showProfiles={isAdmin}
+        ownHome={ownHome}
      />

      <Tabs current={tab} onSelect={(k) => void setTab(k)} counts={data.overview?.counts} />
@@ -777,7 +792,7 @@ export function CcConfig() {

      {/* AgentHub's own Claude Code settings follow the overview, outside the
          list's search box and scope. */}
-      {tab === "overview" && (
+      {tab === "overview" && isAdmin && (
        <ClaudeAgentHubSettings key={agenthubKey} onHomeChanged={() => void fetchAll()} />
      )}

@@ -820,10 +835,22 @@ interface HeaderProps {
  onRefresh: () => void;
  onOpenBackups: () => void;
  wsConnected: boolean;
+  /** The host's login profiles link: an admin's (and local mode's). */
+  showProfiles?: boolean;
+  /** A member's own Claude home (server mode, S3): the page says whose it is. */
+  ownHome?: string | null;
 }

 /** The page's toolbar. No title of its own: the Settings hub already draws one. */
-function Header({ loading, lastUpdated, onRefresh, onOpenBackups, wsConnected }: HeaderProps) {
+function Header({
+  loading,
+  lastUpdated,
+  onRefresh,
+  onOpenBackups,
+  wsConnected,
+  showProfiles = true,
+  ownHome = null,
+}: HeaderProps) {
  const { t } = useTranslation("ccConfig");
  const settingsHref = useSettingsHref();
  const { t: tCommon } = useTranslation("common");
@@ -848,18 +875,30 @@ function Header({ loading, lastUpdated, onRefresh, onOpenBackups, wsConnected }:
            {tCommon("offline")}
          </span>
        )}
-        <p className="text-xs text-fg-muted max-w-2xl">{t("subtitle")}</p>
+        {ownHome ? (
+          <div className="min-w-0">
+            <p className="text-xs font-medium text-fg-primary" data-testid="cc-own-config">
+              {t("own.label", { home: ownHome })}
+            </p>
+            <p className="text-xs text-fg-muted max-w-2xl">{t("own.subtitle")}</p>
+          </div>
+        ) : (
+          <p className="text-xs text-fg-muted max-w-2xl">{t("subtitle")}</p>
+        )}
      </div>
      <div className="flex flex-col items-stretch lg:items-end gap-2 flex-shrink-0">
        <div className="flex items-center gap-2 justify-end flex-wrap">
-          {/* Every AI tool's login profiles live in one place: Settings → AI tools. */}
-          <Link
-            to={settingsHref("agents#tool-profiles")}
-            className="inline-flex items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-xs font-medium text-fg-secondary hover:bg-surface-3 transition-colors"
-          >
-            <UserCog className="w-3.5 h-3.5" />
-            {t("profiles.openButton")}
-          </Link>
+          {/* Every AI tool's login profiles live in one place: Settings → AI tools.
+              The host's logins: an admin's. */}
+          {showProfiles && (
+            <Link
+              to={settingsHref("agents#tool-profiles")}
+              className="inline-flex items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-xs font-medium text-fg-secondary hover:bg-surface-3 transition-colors"
+            >
+              <UserCog className="w-3.5 h-3.5" />
+              {t("profiles.openButton")}
+            </Link>
+          )}
          <button
            type="button"
            onClick={onOpenBackups}
@@ -1290,18 +1329,31 @@ function OverviewPanel({ overview }: { overview: CcOverview | null }) {
          {t("overview.rootsTitle")}
        </h2>
        <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
-          <RootRow
-            icon={FolderTree}
-            tone="emerald"
-            label={t("overview.projectClaudeDir")}
-            value={roots.projectClaudeDir}
-          />
-          <RootRow
-            icon={FolderTree}
-            tone="violet"
-            label={t("overview.projectRoot")}
-            value={roots.projectRoot}
-          />
+          {/* A member's own config has no project layer: their Claude home instead. */}
+          {roots.projectRoot === null && (
+            <RootRow
+              icon={FolderTree}
+              tone="emerald"
+              label={t("overview.claudeHome")}
+              value={roots.claudeHome}
+            />
+          )}
+          {roots.projectClaudeDir !== null && (
+            <RootRow
+              icon={FolderTree}
+              tone="emerald"
+              label={t("overview.projectClaudeDir")}
+              value={roots.projectClaudeDir}
+            />
+          )}
+          {roots.projectRoot !== null && (
+            <RootRow
+              icon={FolderTree}
+              tone="violet"
+              label={t("overview.projectRoot")}
+              value={roots.projectRoot}
+            />
+          )}
          <RootRow
            icon={FileText}
            tone="amber"
@@ -1718,6 +1770,7 @@ function PluginsPanel({
  onChanged: () => void;
 }) {
  const { t } = useTranslation("ccConfig");
+  const { isAdmin } = usePermissions();
  const { busy, run } = useConfigAction(onToast, onChanged);
  const [input, setInput] = useState("");
  const [available, setAvailable] = useState<CcAvailablePlugin[] | null>(null);
@@ -1785,7 +1838,8 @@ function PluginsPanel({
        commands={[{ cmd: t("explain.plugins.installCmd"), note: "" }]}
      />

-      <UpdateAllCard onToast={onToast} onChanged={onChanged} />
+      {/* Update all runs on the host's plugins (AgentHub's own included): an admin's. */}
+      {isAdmin && <UpdateAllCard onToast={onToast} onChanged={onChanged} />}

      <div className="rounded-lg border border-accent/25 bg-accent/5 px-3 py-2.5">
        <div className="text-[11px] font-semibold text-fg-secondary mb-1.5">
@@ -27,6 +27,9 @@
 * /workspace, `lib/settingsLink.ts`): the same pages, every link kept in the
 * tab (replaced, as a tab click), no Back link, and Ctrl/Cmd+F left alone
 * while the tab is hidden behind a session.
+ * Server mode hides every tool page from a non-admin, except Claude Code for a
+ * non-admin with their own Linux account (`useCcTarget`): "Your Claude Code
+ * config", which they manage as themselves.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import {
@@ -75,6 +78,7 @@ import { PricingSettings } from "../components/settings/PricingSettings";
 import { WorktreeVisibilitySettings } from "../components/settings/WorktreeVisibilitySettings";
 import { ChangesPanelSettings } from "../components/settings/ChangesPanelSettings";
 import { useAiTools } from "../hooks/useAiTools";
+import { useCcTarget } from "../hooks/useCcTarget";
 import {
  rankSettings,
  rankSettingsEntries,
@@ -248,10 +252,14 @@ export function SettingsHub({ section }: { section?: string } = {}) {
    };
  }, [location.key, location.hash]);

-  const { isAdmin, local } = usePermissions();
+  const { isAdmin, local, seesAll } = usePermissions();
  const authState = useAuth().state;
  const signedIn = authState.mode === "server" && !!authState.user;
  const enabled = (id: string) => aiTools.byId(id)?.enabled !== false;
+  // Server mode: a non-admin with their own Linux account (S3) manages their
+  // OWN Claude Code config here; the host's stays an admin's.
+  const ccTarget = useCcTarget();
+  const ownClaude = !isAdmin && ccTarget?.kind === "own";
  const s = (key: string) => ({
    title: t(`settingsNav.section.${key}.title`),
    description: t(`settingsNav.section.${key}.description`),
@@ -299,8 +307,9 @@ export function SettingsHub({ section }: { section?: string } = {}) {
          <AgentInstructionsSettings />
          <SessionDefaultsSettings />
          <AiToolsSettings settingsHref={toolHref} />
-          {/* Every AI tool's login profiles, linked to the account pool. */}
-          <ToolProfilesSettings />
+          {/* Every AI tool's login profiles, linked to the account pool: the
+              host's logins, a staff-only read (a developer would get 403s). */}
+          {seesAll && <ToolProfilesSettings />}
          {/* The Hub's install switch: server mode, an admin's (it hides itself). */}
          <ArtifactsHubSettings />
          {/* The host's omp login for members: server mode + S3, an admin's. */}
@@ -315,7 +324,7 @@ export function SettingsHub({ section }: { section?: string } = {}) {
            group: "agents" as const,
            tool: "claude",
            Icon: toolNavIcon("claude", "Claude Code"),
-            ...s("claudeCode"),
+            ...s(ownClaude ? "claudeCodeOwn" : "claudeCode"),
            render: () => <CcConfig />,
          },
        ]
@@ -439,7 +448,10 @@ export function SettingsHub({ section }: { section?: string } = {}) {
  // server answers 403 EADMIN), so its pages — every tool's too — are hidden.
  const sections = isAdmin
    ? allSections
-    : allSections.filter((x) => !x.tool && !ADMIN_SECTIONS.has(x.id));
+    : allSections.filter(
+        (x) =>
+          (!x.tool && !ADMIN_SECTIONS.has(x.id)) || (ownClaude && x.id === "agents/claude-code")
+      );
  const navSections = sections.filter((x) => !x.tool);
  const toolTabs = sections.filter((x) => x.tool);
  function toolHref(id: string) {
@@ -1251,7 +1251,7 @@ export function Workspace() {
    }
  };

-  // Mirrors `agenthub lanes pipeline <template> <id>`: same PATCH, same
+  // Mirrors `agenthub workspace pipeline <template> <id>`: same PATCH, same
  // stage-mismatch warning when the current declared stage matches no node
  // in the newly chosen template.
  const handlePipelineChange = async (id: number, pipeline: string) => {
@@ -1420,7 +1420,7 @@ export function Workspace() {
                    <div data-testid="proof-gallery" className="mt-2">
                      {proofFeature.ticket_report && (
                        <a
-                          href={`/api/lanes/${currentLane.id}/proof/${proofFeature.ticket_report}`}
+                          href={`/api/workspaces/${currentLane.id}/proof/${proofFeature.ticket_report}`}
                          target="_blank"
                          rel="noreferrer"
                          className="text-xs text-fg-muted"
@@ -13,6 +13,10 @@
 * the sandbox cannot show (Office, zip, PDF) offers Download only, the
 * Add menu closes on Escape or a click outside it, the front page is shelved
 * by kind until a category is picked, and a card opens its detail sheet.
+ * Rows carry one primary action; Preview, Share and Edit live in the ⋯ menu.
+ * A section shows 30 entries before "Show more", and three or more skills of
+ * one owner sharing a name prefix are one pack row that installs them all.
+ * An installed skill whose owner changed it shows Update (after a confirmation).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -33,6 +37,7 @@ vi.mock("../../lib/api", () => ({
      update: vi.fn(),
      remove: vi.fn(),
      install: vi.fn(),
+      updateInstalled: vi.fn(),
      uninstall: vi.fn(),
      installs: vi.fn(),
      setInstallsEnabled: vi.fn(),
@@ -113,6 +118,16 @@ const addMenu = async (user: ReturnType<typeof userEvent.setup>, label: string)
  await user.click(screen.getByRole("button", { name: label }));
 };

+/** Run one item of the first (or the given) row's ⋯ menu. */
+async function menuAction(
+  user: ReturnType<typeof userEvent.setup>,
+  name: string,
+  scope: HTMLElement = document.body
+) {
+  await user.click(within(scope).getAllByRole("button", { name: "More actions" })[0]!);
+  await user.click(within(screen.getByTestId("artifact-menu")).getByRole("menuitem", { name }));
+}
+
 describe("Adding", () => {
  it("adds the plugins picked from a marketplace link", async () => {
    const user = userEvent.setup();
@@ -218,13 +233,22 @@ describe("Artifacts", () => {
    const user = userEvent.setup();
    open();
    expect(await screen.findByRole("button", { name: "Hub" })).toBeInTheDocument();
-    expect(screen.getAllByRole("button", { name: /^Share$/ }).length).toBe(2);
-    // One merged list by default; Hub is a filter over it.
-    expect(api.artifacts.list).toHaveBeenLastCalledWith(expect.objectContaining({ scope: "all" }));
+    await user.click(screen.getAllByRole("button", { name: "More actions" })[0]!);
+    expect(
+      within(screen.getByTestId("artifact-menu")).getByRole("menuitem", { name: "Share" })
+    ).toBeInTheDocument();
+    await user.keyboard("{Escape}");
+    // One merged list by default; Hub is a filter over it. The Suggested
+    // count's own `unowned` list runs whenever settings land, so it is left
+    // out: only the order of the LIST loads is under test.
+    const listScopes = () =>
+      vi
+        .mocked(api.artifacts.list)
+        .mock.calls.map(([opts]) => opts?.scope)
+        .filter((s) => s !== "unowned");
+    expect(listScopes().pop()).toBe("all");
    await user.click(screen.getByRole("button", { name: "Hub" }));
-    await waitFor(() =>
-      expect(api.artifacts.list).toHaveBeenLastCalledWith(expect.objectContaining({ scope: "hub" }))
-    );
+    await waitFor(() => expect(listScopes().pop()).toBe("hub"));
  });

  it("splits the Hub and My library into yours and others'", async () => {
@@ -271,20 +295,46 @@ describe("Artifacts", () => {
    expect(within(screen.getByTestId("half-mine.own")).getByText("my-page")).toBeInTheDocument();
  });

-  it("pages a long section 12 cards at a time", async () => {
+  it("shows a long section 30 entries at a time, then the rest on Show more", async () => {
    vi.mocked(api.artifacts.list).mockResolvedValue({
-      items: Array.from({ length: 14 }, (_, i) =>
+      items: Array.from({ length: 34 }, (_, i) =>
        item({ id: i + 1, kind: "page", title: `p${i + 1}`, files: [] })
      ),
    });
    const user = userEvent.setup();
    open();
    await screen.findByText("p1");
-    expect(screen.queryByText("p13")).toBeNull();
-    expect(screen.getByText("Showing 1-12 of 14")).toBeInTheDocument();
-    await user.click(screen.getByRole("button", { name: "Next" }));
-    expect(screen.getByText("p13")).toBeInTheDocument();
-    expect(screen.queryByText("p1")).toBeNull();
+    expect(screen.getByText("p30")).toBeInTheDocument();
+    expect(screen.queryByText("p31")).toBeNull();
+    await user.click(screen.getByRole("button", { name: "Show 4 more" }));
+    expect(screen.getByText("p34")).toBeInTheDocument();
+    expect(screen.getByText("p1")).toBeInTheDocument();
+  });
+
+  it("folds three skills sharing a name prefix into one pack that installs them all", async () => {
+    vi.mocked(api.artifacts.list).mockResolvedValue({
+      items: [
+        item({ id: 1, kind: "skill", title: "sg-qa", source: "sg-qa" }),
+        item({ id: 2, kind: "skill", title: "sg-ship", source: "sg-ship", installed: true }),
+        item({ id: 3, kind: "skill", title: "sg-fix", source: "sg-fix" }),
+        item({ id: 4, kind: "skill", title: "lone", source: "lone" }),
+      ],
+    });
+    vi.mocked(api.artifacts.install).mockResolvedValue({ installed: "/h/x" } as never);
+    const user = userEvent.setup();
+    open();
+    const pack = await screen.findByTestId("pack-sg");
+    expect(within(pack).getByText("sg-* pack")).toBeInTheDocument();
+    expect(within(pack).getByText("3 skills")).toBeInTheDocument();
+    expect(screen.queryByTestId("artifact-1")).toBeNull();
+    expect(screen.getByTestId("artifact-4")).toBeInTheDocument();
+    await user.click(within(pack).getByRole("button", { expanded: false }));
+    expect(within(pack).getByTestId("artifact-1")).toBeInTheDocument();
+    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
+    await user.click(within(pack).getByRole("button", { name: "Install 2 more" }));
+    await waitFor(() => expect(api.artifacts.install).toHaveBeenCalledTimes(2));
+    expect(api.artifacts.install).toHaveBeenCalledWith(1);
+    expect(api.artifacts.install).toHaveBeenCalledWith(3);
  });

  it("lists who installed an artifact, when and where, from its install count", async () => {
@@ -333,12 +383,38 @@ describe("Artifacts", () => {
    expect(within(card).getByText("Hub only")).toBeInTheDocument();
    expect(within(card).queryByRole("button", { name: "Delete" })).toBeNull();
    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
-    await user.click(within(card).getByRole("button", { name: "Remove from Hub" }));
+    await menuAction(user, "Remove from Hub", card);
    await waitFor(() => expect(api.artifacts.update).toHaveBeenCalledWith(3, { shared: false }));
    const calls = vi.mocked(confirmDialog).mock.calls;
    expect(calls[calls.length - 1]?.[0].title).toMatch(/Remove “hub-only” from the Hub/);
  });

+  it("offers Update for an installed skill its owner changed, after a confirmation", async () => {
+    vi.mocked(api.artifacts.list).mockResolvedValue({
+      items: [
+        item({
+          id: 2,
+          kind: "skill",
+          title: "deploy",
+          source: "deploy",
+          installed: true,
+          updateAvailable: true,
+        }),
+      ],
+    });
+    vi.mocked(api.artifacts.updateInstalled).mockResolvedValue({ installed: "/h/x" });
+    const user = userEvent.setup();
+    open();
+    const card = await screen.findByTestId("artifact-2");
+    expect(within(card).queryByTestId("artifact-installed")).toBeNull();
+    vi.mocked(confirmDialog).mockResolvedValueOnce(false);
+    await user.click(within(card).getByRole("button", { name: "Update" }));
+    expect(api.artifacts.updateInstalled).not.toHaveBeenCalled();
+    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
+    await user.click(within(card).getByRole("button", { name: "Update" }));
+    await waitFor(() => expect(api.artifacts.updateInstalled).toHaveBeenCalledWith(2));
+  });
+
  it("shows Installed instead of Install for a skill already installed", async () => {
    vi.mocked(api.artifacts.list).mockResolvedValue({
      items: [item({ id: 2, kind: "skill", title: "deploy", source: "deploy", installed: true })],
@@ -436,7 +512,7 @@ describe("Artifacts", () => {
    const user = userEvent.setup();
    open();
    await screen.findByText("standup");
-    await user.click(screen.getByRole("button", { name: "Preview" }));
+    await menuAction(user, "Preview");
    expect(await screen.findByRole("heading", { name: "Daily standup" })).toBeInTheDocument();
    expect(screen.getByTestId("skill-summary")).toHaveTextContent("/out/report.html");
    expect(screen.queryByTestId("artifact-preview")).toBeNull();
@@ -464,7 +540,7 @@ describe("Artifacts", () => {
    const user = userEvent.setup();
    open();
    await screen.findByText("standup");
-    await user.click(screen.getByRole("button", { name: "Edit" }));
+    await menuAction(user, "Edit");
    const name = await screen.findByLabelText(/Skill name/);
    expect(name).toHaveValue("standup");
    expect(screen.getByLabelText(/Instructions/)).toHaveValue("Old body");
@@ -0,0 +1,133 @@
+/**
+ * @file Covers the Claude Code config page as a MEMBER's own config (server
+ * mode, a non-admin with their own Linux account): it says whose config it is,
+ * and the host-wide controls — Switch profile, Update all, AgentHub's own
+ * Claude settings — are not shown (the server refuses them anyway). An admin
+ * still sees all three.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, act } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router-dom";
+
+const perms = vi.hoisted(() => ({ isAdmin: false }));
+vi.mock("../../components/AuthGate", async (importOriginal) => {
+  const m = await importOriginal<typeof import("../../components/AuthGate")>();
+  return {
+    ...m,
+    usePermissions: () => ({ ...m.usePermissions(), local: false, isAdmin: perms.isAdmin }),
+  };
+});
+vi.mock("../../components/settings/ClaudeAgentHubSettings", () => ({
+  ClaudeAgentHubSettings: () => <div data-testid="agenthub-claude-settings" />,
+}));
+
+const HOME = "/srv/users/mia/.claude";
+const ccConfigMock = vi.hoisted(() => {
+  const r = (value: unknown) => vi.fn().mockResolvedValue(value);
+  return {
+    target: r({ kind: "own", readOnly: false, claudeHome: "/srv/users/mia/.claude" }),
+    overview: r({
+      roots: {
+        claudeHome: "/srv/users/mia/.claude",
+        projectClaudeDir: null,
+        projectRoot: null,
+        claudeJson: "/srv/users/mia/.claude.json",
+      },
+      counts: {
+        skills: { user: 0, project: 0 },
+        agents: { user: 0, project: 0 },
+        commands: { user: 0, project: 0 },
+        outputStyles: { user: 0, project: 0 },
+        mcpServers: { user: 0, project: 0 },
+        hooks: {},
+        plugins: 0,
+        marketplaces: 0,
+        keybindings: 0,
+        settingsFiles: 0,
+        memory: 0,
+      },
+    }),
+    skills: r({ items: [] }),
+    agents: r({ items: [] }),
+    commands: r({ items: [] }),
+    outputStyles: r({ items: [] }),
+    memory: r({ items: [] }),
+    plugins: r({ manifestPath: null, manifestExists: false, plugins: [] }),
+    marketplaces: r({ items: [] }),
+    mcp: r({ user: [], projectScoped: [] }),
+    hooks: r({ items: [] }),
+    settings: r({ items: [] }),
+    keybindings: r({ groups: [] }),
+    statusline: r({}),
+    hookScripts: r({ items: [] }),
+    backups: r({ items: [] }),
+    pluginsAvailable: r({ installed: [], available: [] }),
+    updateAllStatus: r({ batch: null }),
+  };
+});
+
+vi.mock("../../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return {
+    ...actual,
+    api: { ...(actual.api as Record<string, unknown>), ccConfig: ccConfigMock },
+  };
+});
+
+vi.mock("../../lib/eventBus", () => ({
+  eventBus: {
+    subscribe: () => () => {},
+    publish: () => {},
+    onConnection: () => () => {},
+    connected: true,
+    setConnected: () => {},
+  },
+}));
+
+import { CcConfig } from "../CcConfig";
+
+async function settle() {
+  await act(async () => {
+    await new Promise((res) => setTimeout(res, 0));
+    await new Promise((res) => setTimeout(res, 0));
+  });
+}
+
+async function open() {
+  render(
+    <MemoryRouter>
+      <CcConfig />
+    </MemoryRouter>
+  );
+  await settle();
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  perms.isAdmin = false;
+});
+
+describe("CcConfig — a member's own config", () => {
+  it("says whose config it is and hides the host-wide controls", async () => {
+    await open();
+    expect(screen.getByTestId("cc-own-config")).toHaveTextContent(HOME);
+    expect(screen.queryByRole("link", { name: /switch profile/i })).not.toBeInTheDocument();
+    expect(screen.queryByTestId("agenthub-claude-settings")).not.toBeInTheDocument();
+    await userEvent.click(screen.getByRole("tab", { name: /plugins/i }));
+    await settle();
+    expect(screen.queryByRole("button", { name: /^update all$/i })).not.toBeInTheDocument();
+    expect(ccConfigMock.updateAllStatus).not.toHaveBeenCalled();
+  });
+
+  it("keeps all three for an admin", async () => {
+    perms.isAdmin = true;
+    await open();
+    expect(screen.queryByTestId("cc-own-config")).not.toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /switch profile/i })).toBeInTheDocument();
+    expect(screen.getByTestId("agenthub-claude-settings")).toBeInTheDocument();
+    expect(ccConfigMock.target).not.toHaveBeenCalled();
+  });
+});
@@ -21,10 +21,15 @@ import { MemoryRouter, Route, Routes, useLocation } from "react-router-dom";
 import type { AiTool, AiToolsView } from "../../lib/api";

 // Local mode unless a test says otherwise; still an admin either way.
-const perms = vi.hoisted(() => ({ local: true }));
+const perms = vi.hoisted(() => ({ local: true, isAdmin: true }));
+// What GET /api/cc-config/target answers a non-admin.
+const ccTarget = vi.hoisted(() => ({ kind: "none" as "own" | "host" | "none" }));
 vi.mock("../../components/AuthGate", async (importOriginal) => {
  const m = await importOriginal<typeof import("../../components/AuthGate")>();
-  return { ...m, usePermissions: () => ({ ...m.usePermissions(), local: perms.local }) };
+  return {
+    ...m,
+    usePermissions: () => ({ ...m.usePermissions(), local: perms.local, isAdmin: perms.isAdmin }),
+  };
 });
 vi.mock("../../components/settings/GitIdentitySettings", () => ({
  GitIdentitySettings: () => <div data-testid="git-identity" />,
@@ -88,7 +93,14 @@ vi.mock("../../lib/api", async (importOriginal) => {
      lanes: { list: vi.fn(async () => ({ lanes: [], counts: {} })) },
      // AI tools → Profiles.
      toolProfiles: { list: vi.fn(async () => ({ tools: [] })) },
-      ccConfig: { profiles: vi.fn(async () => ({ items: [], active: null })) },
+      ccConfig: {
+        profiles: vi.fn(async () => ({ items: [], active: null })),
+        target: vi.fn(async () => ({
+          kind: ccTarget.kind,
+          readOnly: ccTarget.kind !== "own",
+          claudeHome: ccTarget.kind === "own" ? "/srv/users/mia/.claude" : null,
+        })),
+      },
    },
  };
 });
@@ -124,6 +136,8 @@ const nav = () => screen.getByRole("navigation", { name: "Settings sections" });

 beforeEach(() => {
  perms.local = true;
+  perms.isAdmin = true;
+  ccTarget.kind = "none";
  __resetAiTools();
  view = {
    default: "claude",
@@ -202,6 +216,29 @@ describe("SettingsHub", () => {
    expect(screen.getByTestId("ai-tools")).toBeInTheDocument();
  });

+  it("gives a non-admin with their own account their own Claude Code page, and no other tool's", async () => {
+    perms.local = false;
+    perms.isAdmin = false;
+    ccTarget.kind = "own";
+    renderAt("/settings/agents/claude-code");
+    expect(await screen.findByTestId("cc-config")).toBeInTheDocument();
+    const tabs = within(screen.getByRole("tablist", { name: "AI tool settings" }))
+      .getAllByRole("tab")
+      .map((a) => a.textContent);
+    expect(tabs).toEqual(["All tools", "Your Claude Code config"]);
+  });
+
+  it("keeps the Claude Code page from a non-admin with no account of their own", async () => {
+    perms.local = false;
+    perms.isAdmin = false;
+    ccTarget.kind = "none";
+    renderAt("/settings/agents/claude-code");
+    expect(
+      await screen.findByRole("heading", { level: 1, name: "Appearance" })
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("cc-config")).not.toBeInTheDocument();
+  });
+
  it("navigates from the mobile select", async () => {
    renderAt("/settings/data");
    await screen.findByTestId("settings-data");
@@ -99,6 +99,12 @@ export default defineConfig({
  },
  build: {
    outDir: "dist",
+    // ES2021 or newer, never Vite's es2020 default: esbuild 0.25 lowers
+    // xterm 6's `let r; …(r||={})` (requestMode, DECRQM) to `void 0||(i={})`
+    // and drops the `let`, so every DECRQM query tmux sends threw
+    // "i is not defined" inside the terminal's parser. React 19 needs these
+    // browsers anyway.
+    target: ["es2021", "chrome100", "edge100", "firefox100", "safari15"],
    // Maps are still written (for debugging a build), but no bundle points at
    // them, so a browser never downloads them.
    sourcemap: "hidden",
@@ -239,7 +239,7 @@ Manage the remote (SSH) machines this dashboard pulls Claude Code history from

 A workspace is a durable unit of parallel agent work — one working directory, many sessions over time. Full guide: [`docs/LANES.md`](LANES.md).

-`agenthub workspace …` (or `agenthub workspaces` for the list) is the name to use. `agenthub lanes …` and `--lane <id>` are the old names and keep working — the same commands as `agenthub workspace …` and `--workspace <id>` — so scripts and skills written before the rename need no change.
+`agenthub workspace …` (or `agenthub workspaces` for the list) is the name to use. The old names `agenthub lanes …` and `--lane <id>` were removed (step 4 of the rename): they exit 1 with `renamed: use agenthub workspace …` / `renamed: use --workspace <id>`. Your workspaces, sessions and history are unchanged, and the API still answers under both `/api/workspaces` and `/api/lanes`.

 | Command | Description |
 | ------- | ----------- |
@@ -271,7 +271,7 @@ A workspace is a durable unit of parallel agent work — one working directory,

 Omit `<id>` and the command addresses the workspace owning the current directory, so a session running inside a workspace never needs to know its own id. Only a leading all-digits argument is read as an id — `agenthub workspace logs web --tail 4096` addresses the workspace by directory, not workspace 4096.

-Resolution order, shared by every cwd-resolving command: `--workspace` (old name `--lane`)/leading id → `AGENTHUB_LANE_ID` (exported into every tmux pane the dashboard starts) → `--tool <id>`, else the harness's marker (`CLAUDECODE` means claude; Codex has no equivalent marker, so a codex session outside a dashboard pane passes `--tool codex`) → the workspace owning the directory. One directory can back a `claude` workspace and a `codex` workspace at once, so when two candidates remain the command fails and names both instead of picking one — see [Which workspace a CLI command addresses](LANES.md#which-workspace-a-cli-command-addresses).
+Resolution order, shared by every cwd-resolving command: `--workspace`/leading id → `AGENTHUB_LANE_ID` (exported into every tmux pane the dashboard starts) → `--tool <id>`, else the harness's marker (`CLAUDECODE` means claude; Codex has no equivalent marker, so a codex session outside a dashboard pane passes `--tool codex`) → the workspace owning the directory. One directory can back a `claude` workspace and a `codex` workspace at once, so when two candidates remain the command fails and names both instead of picking one — see [Which workspace a CLI command addresses](LANES.md#which-workspace-a-cli-command-addresses).

 Because a workspace's services are fully detached, restarting the dashboard (or applying an update — `agenthub update-check` reports one, the dashboard's Update button applies it) never stops a running stack.

@@ -260,7 +260,6 @@ DASHBOARD_ANTIGRAVITY_POLL_MS=15000     # agy conversation files → Antigravity
 AGENTHUB_GEMINI_DIR=                    # where agy keeps its data (default ~/.gemini)
 DASHBOARD_CURSOR_POLL_MS=15000          # Cursor agent transcripts → Cursor sessions (no tokens; 60 s while idle)
 DASHBOARD_OMP_POLL_MS=15000             # omp session journals → Oh My Pi sessions/tokens/subagents (60 s while idle)
-DASHBOARD_OPENCODE_POLL_MS=15000        # opencode.db → OpenCode sessions/tokens/subagents (60 s while idle)
 AGENTHUB_CURSOR_DIR=                    # where Cursor keeps its data (default ~/.cursor)
 AGENTHUB_AGY_USAGE=                     # 0 never runs `agy --print /usage` for the Usage panel's Antigravity quota (default on; running agy may update it)

@@ -310,13 +310,10 @@ per model and one agent per subagent the `task` tool spawned (its journal sits i
 the folder named like the session's). An omp session can be resumed by id from
 its workspace (`omp --resume <id>`), like a Claude or Codex one.

-**OpenCode** sessions are read from its SQLite store
-(`~/.local/share/opencode/opencode.db`, every `DASHBOARD_OPENCODE_POLL_MS` ms),
-with their tokens and cost per model and one agent per subagent, and are
-resumable by id (`opencode --session <id>`). **Grok Build** runs the Claude hooks in
-`~/.claude/settings.json` itself, so its sessions arrive through AgentHub's own
-hooks, recorded as Grok sessions (live status, no tokens); they resume with
-`grok --resume <id>`. Cursor sessions resume by id too (`--resume <id>`).
+Cursor sessions resume by id too (`--resume <id>`), and open as a chat like
+omp ones. OpenCode and Grok Build are no longer AgentHub tools: a Grok Build
+running the Claude hooks in `~/.claude/settings.json` is ignored, and sessions an
+older build recorded for either stay in the history.

 **Pipelines are dormant.** AgentHub ships no pipeline template, so a workspace has no
 stages until you drop a template JSON into `DASHBOARD_PIPELINES_DIR` (see
@@ -377,7 +374,7 @@ both full suites.
 | Path | What |
 |---|---|
 | `server/` | Express API, SQLite schema, hook ingest, workspace and worktree libraries |
-| `client/` | React 18 + Vite + Tailwind dashboard |
+| `client/` | React 19 + Vite + Tailwind dashboard |
 | `bin/agenthub.js` | CLI |
 | `mcp/`, `statusline/` | Read-only MCP server and Claude Code statusline (opt-in) |
 | `monitoring/` | Prometheus config/rules and Grafana boards for `/api/metrics` |
@@ -293,7 +293,7 @@ chạy cả hai bộ đầy đủ.
 | Đường dẫn | Là gì |
 |---|---|
 | `server/` | Express API, schema SQLite, hook ingest, thư viện workspace và worktree |
-| `client/` | Dashboard React 18 + Vite + Tailwind |
+| `client/` | Dashboard React 19 + Vite + Tailwind |
 | `bin/agenthub.js` | CLI |
 | `docs/` | Architecture, API, workspaces, database |
 | `plugins/` | Các Claude Code plugin đi kèm dashboard |
@@ -194,8 +194,8 @@ graph TB

 | Layer | Technology |
 |-------|------------|
-| **Frontend** | React 18, TypeScript 5.7, Vite 6, Tailwind CSS |
-| **Backend** | Node.js 20+, Express 4.21, WebSocket |
+| **Frontend** | React 19, TypeScript 7, Vite 6, Tailwind CSS |
+| **Backend** | Node.js 22.5+, Express 5, WebSocket |
 | **Database** | SQLite 3 (better-sqlite3 or node:sqlite) |
 | **Integration** | Claude Code Hooks, MCP Server |

@@ -65,7 +65,7 @@ The proxy has to:
 - forward WebSocket upgrades (`/ws` for live updates, `/ws-pty/*` for terminals);
 - set `X-Forwarded-For` and `X-Forwarded-Proto`;
 - accept request bodies as large as AgentHub's own limits (Files uploads up to
-  500 MB, prompt drops 20 MB). nginx's default `client_max_body_size` is 1 MB,
+  500 MB, files dropped on a terminal or a prompt box 500 MB, dropped images 20 MB). nginx's default `client_max_body_size` is 1 MB,
  and its own 413 is an HTML page the UI can only report as a failed upload.

 nginx:
@@ -106,11 +106,13 @@ The login cookie gets `Secure` when the request came over HTTPS
 start (`server/db.js`), and `member` is no longer accepted.

 "The host's configuration" means a write (anything but GET/HEAD) under
-`/api/settings`, `/updates`, `/cc-config`, `/codex-config`,
+`/api/settings`, `/updates`, `/codex-config`,
 `/git-credentials`, `/ai-tools`, `/import`, `/pricing`, `/budgets`,
 `/webhooks`, `/remote-sources`, `/reports`, `/pets`, `/users` and
 `/alerts/rules` (`ADMIN_WRITE_PREFIXES` in `server/lib/auth.js`), plus a write
-to a shared AI Proxy (see [AI Proxy profiles](#ai-proxy-profiles)). A
+to a shared AI Proxy (see [AI Proxy profiles](#ai-proxy-profiles)) and the
+host-wide parts of `/cc-config` (see
+[Your own Claude Code config](#your-own-claude-code-config)). A
 developer or analyst who tries one gets `403 EADMIN`, shown in the UI as "Only
 an admin can do this". An analyst's other writes are scoped like a
 developer's: one naming another user's row gets `404 ENOTFOUND` (`memberId` in
@@ -120,7 +122,8 @@ exactly like a developer's.

 The UI hides what a role cannot use (`usePermissions` in
 `client/src/components/AuthGate.tsx`): for anyone but an admin, Settings shows
-no Data, Pricing or per-tool pages, no scheduled reports or git credentials,
+no Data, Pricing or per-tool pages (except their own Claude Code config,
+for a user with their own Linux account), no scheduled reports or git credentials,
 no start-at-login/icon/Quit/Uninstall on System, no alert rules or channels,
 no install/update/enable on AI tools, no pet upload or delete, and no update
 check; the AI proxy page shows them only their personal profiles' Edit. An
@@ -774,6 +777,52 @@ folder under it), and the dark/light mode picked in AgentHub becomes Claude's
 theme. Accepting Bypass Permissions mode stays the member's own choice, made
 in their terminal.

+### Your own Claude Code config
+
+With S3, a developer or analyst who has their own Linux account manages THEIR
+OWN Claude Code configuration in Settings → AI tools → **Your Claude Code
+config** — skills, subagents, commands, output styles, `CLAUDE.md` and
+auto-memory, plugins, marketplaces, MCP servers, `settings.json` (hooks
+included) and `keybindings.json` — the same Config Explorer an admin uses for
+the host's, pointed at `<USERS_ROOT>/<name>/.claude` and
+`<USERS_ROOT>/<name>/.claude.json`. How it runs:
+
+- `/api/cc-config` gates itself (`server/lib/cc-target.js`): a non-admin
+  reaches only an allowlist of reads and of the writes that run as them.
+  `/profiles*` (the host's login switching), `/plugins/update-all` (the host's
+  Update all, AgentHub's own plugin included) and any endpoint not on the list
+  stay an admin's (`403 EADMIN`; an analyst may still READ the profiles and the
+  Update-all journal, as before). Every handler then resolves ONE target: the
+  host's Claude home for an admin (and in local mode) exactly as before, the
+  member's own home otherwise, and `403 ENOACCOUNT` for a non-admin with no
+  enabled, provisioned account — never the host's. An analyst with no account
+  keeps the read-only view of the host's config they had; with one, `?view=host`
+  gives them that view, and the file reader serves either.
+- Every file write is the member's own: `write-as` (content on stdin), the
+  timestamped backup a `write-as copy` inside their home; their files are read
+  only through the guarded reader (a regular file they own, size capped), and
+  a directory, plugin `installPath` or marketplace `installLocation` that leads
+  out of their home is not followed.
+- `claude plugin …`, `claude plugin marketplace …` and `claude mcp …` run as
+  them: `sudo -n -u ah-<name> HOME=<home> DISABLE_AUTOUPDATER=1
+  /opt/agenthub/tools/bin/claude …` in their home, with a timeout and the same
+  argument checks. User scope only, never `-y` (a plugin whose marketplace
+  declares an install command fails; install it from your own terminal), and
+  no MCP `env` values or `headers` (sudo logs its argv: add such a server with
+  `claude mcp add` in your own terminal). `503 ENOTSHARED` until `claude` is
+  in the shared tools.
+- A project layer only in one of their own workspaces, named with `?cwd=`
+  (`403 EFOLDER` otherwise); with none named there is no project layer at all,
+  never the dashboard's own folder. An admin's "new CLAUDE.md in a project"
+  in a member's folder is written as that member too.
+- A change is broadcast (`cc_config_changed`) to that member alone, and their
+  **Reload** (`POST /api/cc-config/reload`, or a plugin update with reload)
+  types `/reload-plugins` / `/reload-skills` only into the panes that run as
+  them. Their own config is theirs, so these writes are not audited (like
+  their own File Explorer writes).
+
+Not verified on a live S3 machine yet.
+
 ### Plugin baseline (opt-in)

 Write `/etc/agenthub/plugin-baseline.json` (as
@@ -13,7 +13,7 @@ Opus 5.5 · main · ███░░░░░░░ 34% · $1.23 · today $45.68
 | branch | `git symbolic-ref --short HEAD` in the session's cwd (short sha when detached; 500 ms cap) |
 | context bar | `context_window.used_percentage`, else `current_usage` (input + cache) ÷ `context_window_size`; green < 50 %, yellow < 80 %, red above |
 | `$1.23` | this session, Claude Code's own `cost.total_cost_usd` |
-| `today $…` | every session today, from the dashboard: `GET /api/pricing/cost?tz_offset=<local>` → today's `daily_costs` row |
+| `today $…` | your sessions today, from the dashboard: `GET /api/pricing/cost?tz_offset=<local>&mine=1` → today's `daily_costs` row (in server mode only the pane's workspace owner's sessions, even for an admin; locally every session) |

 Today's cost has a **1-second timeout** and is cached for 30 s in
 `<os tmpdir>/agenthub-statusline-<uid>.json` — a failed fetch is cached too, so a
@@ -9,7 +9,7 @@
 - [NEVER tmux kill-server](never-tmux-kill-server.md) — $TMUX beats TMUX_TMPDIR; it killed the real server + this session twice
 - [Analytics parity plan](analytics-parity-plan.md) — phases 2–7 shipped in v2.4.0; ../agenthub-analytics now redundant; OpenAPI for new routes still missing
 - [Dev/prod ports share one DB](agenthub-dev-prod-ports.md) — 4820 prod (systemd), 4830 user's dev in Warp; same dashboard.db, dev migrations hit prod
- [Workspace rename step 4](workspace-rename-step4.md) — remove `agenthub lanes`/`--lane` only ≥3 releases after aliases ship; never rename stored data
+- [Workspace rename step 4](workspace-rename-step4.md) — DONE 10-26: old CLI names refused, clients call /api/workspaces, /api/lanes kept; release needs EN+VI note
 - [No git stash here](no-git-stash-shared-checkout.md) — parallel sessions share this checkout; use a worktree to test clean HEAD
 - [Update never kills panes](update-never-kills-panes.md) — updates/restarts keep tmux lane panes; only Quit AgentHub (#65) closes them; KillMode=process
 - [Claude Code changelog ≤2.1.295](claude-code-changelog-2-1-293.md) — 2.1.285–295 (to 10-08): hooks onFailure:block (keep AgentHub fail-open), OSC 7501 tested (no use), Workflow scriptPath rules
@@ -1,17 +1,15 @@
 ---
 name: workspace-rename-step4
-description: "Removing the old `agenthub lanes`/`--lane` CLI names is deferred to ≥3 releases after the aliases ship; never touch stored data"
+description: "Rename step 4 DONE 2026-10-26: `agenthub lanes`/`--lane` now exit 1 'renamed'; client/CLI/MCP call /api/workspaces; /api/lanes kept; never touch stored data"
 metadata:
  node_type: memory
  type: project
  originSessionId: 47dc0201-8e49-4fce-9407-f087d3107588
-  modified: 2026-10-06T04:07:56.796Z
+  modified: 2026-10-26T00:00:00.000Z
 ---

-On 2026-10-06 the user had steps 1–3 of the lane→workspace rename built (aliases `/api/workspaces`, `agenthub workspace`, `--workspace`; help/docs on the new name; a stderr deprecation note for `agenthub lanes`/`--lane`). Step 4 (removing the old CLI names, moving client+CLI requests to `/api/workspaces`) is deferred until the THIRD release after the first one that ships the aliases (the first release after v2.0.1). The plan, checklist and "never touch" list are in `docs/plans/workspace-rename/README.md`.
+Step 4 of the lane→workspace rename was built on 2026-10-26 (after v2.8.25): `agenthub lanes …` and `--lane` exit 1 with `renamed: use …`; client `api.ts`, `bin/agenthub.js` and `mcp/server.js` request `/api/workspaces`; the `/api/lanes` mount is KEPT (4c default). Plan: `docs/plans/workspace-rename/README.md`.

-**Why:** the user wants existing installs to update gradually and NOT lose any data — DB tables/columns, response keys, tmux names `agenthub-lane-<id>`, env vars, on-disk paths and browser storage keys must never be renamed.
+**Why:** existing installs update gradually and must not lose data — DB tables/columns, response keys, tmux names `agenthub-lane-<id>`, env vars, on-disk paths and browser storage keys are never renamed.

-**How to apply:** when cutting a release, check whether it is ≥ R+3 (R is recorded in that plan file — fill it in when R is cut) and remind the user that step 4 is due; keep `/api/lanes` unless the user decides otherwise (step 4c, default keep).
-
-R = v2.1.0 (released 2026-10-06), so step 4 is allowed from the 3rd release after v2.1.0.
+**How to apply:** the release that ships this needs the EN+VI note from the plan's release checklist ("`agenthub lanes` and `--lane` are removed — use `agenthub workspace` and `--workspace`…"). Do not remove `/api/lanes` unless the user asks (then 410 ERENAMED for one release first).
@@ -32,5 +32,5 @@ Decisions (user, 2026-10-08):
 - [x] analyst alert feed: `can_ack` per alert, Ack hidden on others' (server test + client test)
 - [x] Settings search: admin-only entries (autostart, quit, tray, reports, webhooks, git creds) hidden
 - [x] SessionDetail: an unstamped session's owner resolved by folder (`owningLane`)
- [ ] prod/dev share one DB: restart prod on the new build together with the first run (migration)
- [ ] `agenthub stop` in server mode answers EAUTH (fix was blocked; user to decide)
+- [x] prod/dev share one DB: restart prod on the new build together with the first run (migration) — done with the v2.5.x rollout
+- [x] `agenthub stop` in server mode answers EAUTH — resolved: `cmdStop` (`bin/agenthub.js`) turns EAUTH/EADMIN into a clear message naming the admin's Quit and the `systemctl` stop commands; a host shell carries no login, so that is the intended answer
@@ -21,7 +21,7 @@ Decided: own Linux user per account; skills/plugins = admin baseline + user's ow
 - [x] Per-user AI Proxy store (+ admin shared) — S3-PLAN P1/P1b
 - [x] S3 provisioning + spawn/attach as the account — S3-PLAN P2/P3
 - [x] S4 shared tools in /opt — S3-PLAN P5
- [ ] Per-user skills/plugins (cc-config per account HOME, admin baseline) — seed + opt-in baseline built (P6); managed-settings spike not run, member Settings not built
+- [ ] Per-user skills/plugins (cc-config per account HOME, admin baseline) — seed + opt-in baseline built (P6); managed-settings spike run 2026-10-09 (works from the first interactive session, S3-PLAN P6); member Settings built 2026-10-26 ("Your Claude Code config", writes as the member) — open until verified live on the S3 box
 - [x] Codex account pool — S3-PLAN P7 (fake accounts only; no real Codex login tried)
 - [x] Security review, docs, suites — P8 F1–F11, second review F12–F20 (2026-10-09), docs/SERVER-MODE.md runbook

@@ -205,7 +205,7 @@ Branch: `server-s3`. Commits happen only when the user asks.
  - Not checked: skills actually listed inside a logged-in session (no login on the test user).
 - [x] Fallback (built, opt-in): with `/etc/agenthub/plugin-baseline.json` (`{"marketplaces": ["owner/repo", …], "plugins": ["name@marketplace", …]}`, root's, the admin edits it), creating a user runs `claude plugin marketplace add <source>` for each marketplace, then `claude plugin install --scope user <plugin>` for each plugin, AS the new member (`sudo -n -u ah-<name> HOME=… /opt/agenthub/tools/bin/claude …`, in the background; `agenthub users provision` runs it too, in the foreground, and is the retry). No file = nothing runs. An entry starting with `-` is skipped; `-y` is never passed. Sudoers: `/opt/agenthub/tools/bin/claude` joins the run-as-member list (no new power: the host already runs any command as a member through tmux). `server/lib/member-claude.js`, test `server-s3-provision.test.js` (fake sudo). Not verified live.
 - [ ] A member's own plugins work from their terminal (`/plugin`) as soon as P3 lands, with no code.
- [ ] Later, optional: Settings for members, using `cc-config` with `home` = `req.user`'s and writes via `sudo -u`.
+- [x] Settings for members, using `cc-config` with `home` = `req.user`'s and writes via `sudo -u`. Done: one target resolver + the router's own allowlist gate (`server/lib/cc-target.js`; `/cc-config` left `STAFF_ONLY_PREFIXES`/`ADMIN_WRITE_PREFIXES`), the readers/writers take the member's home (`cc-discovery`/`cc-mutate` `home`, `noProject`, `ioFor` → write-as; backups via `write-as copy`), `claude plugin|mcp` as the member's sudo argv (user scope, no `-y`, no env/headers), project writes only in their own workspaces, an admin's project-memory create in a member's folder written as the member, `cc_config_changed` to the owner only (`scope.exactAudience`), `/reload` into their own panes; UI "Your Claude Code config" (`useCcTarget`). Test `server-s3-cc-config.test.js` (fake sudo, fake `claude` spawn). Not verified live.

 #### P6 spike: how to run it (a human, on the S3 box)
 `scripts/server/spike-managed-plugins.sh` (never run by AgentHub). It changes `/etc/claude-code/managed-settings.json`, which EVERY Claude Code on the machine reads, the host's own sessions included, so run it in a quiet moment and undo right after.
@@ -1,6 +1,6 @@
 # Workspace redesign — overview and phase plan

-_Status: specs written 2026-10-01, nothing implemented yet. Each phase is one PR, executed in order; a later phase assumes the earlier ones are merged._
+_Status: specs written 2026-10-01; all four phases are built (sidebar tree + status bar + workbench `ba2c4e1`, grouped Settings with search `eb90244`, Orca themes + notification sounds `b71024f`, the lane → workspace copy rename). Kept as the design record. Each phase was one PR, executed in order._

 ## Why

@@ -15,7 +15,7 @@ version here when it is cut: R = `v2.1.0`).
 | 1 | Aliases: `/api/workspaces` = `/api/lanes` (same two routers mounted twice, `server/index.js` `LANE_MOUNTS`); `agenthub workspace`/`workspaces` = `agenthub lanes` (`COMMAND_ALIASES`/`canonicalArgv` in `bin/agenthub.js`); `--workspace <id>` = `--lane <id>` (`resolveLaneArg`). | R | done |
 | 2 | Help, usage and hint text, the UI's command hints and the user docs say `agenthub workspace …` / `--workspace`; `docs/API.md` documents both paths. | R | done |
 | 3 | Deprecation: `agenthub lanes` or `--lane` prints ONE stderr line naming the new spelling (`warnOldNames`), stdout unchanged; the help footer and `docs/CLI.md` call them the old names. | R | done |
-| 4 | Remove the old CLI names (below). | **not before R+3** | open |
+| 4 | Remove the old CLI names (below). | **not before R+3** | done 2026-10-26 (after v2.8.25): 4a + 4b built, 4c kept `/api/lanes` |

 Three releases is the window for an install to update gradually: anyone who
 runs the CLI in that time sees the step-3 note on every old-name call, and a
@@ -142,7 +142,7 @@ const TOOLS = {
  list_lanes: {
    description: "Workspaces (lanes): id, title, folder, AI tool, status and liveness.",
    properties: {},
-    path: () => "/api/lanes",
+    path: () => "/api/workspaces",
  },
  list_pricing: {
    description: "Model pricing rules (USD per million tokens) the cost estimates use.",
@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
  title: Agent Dashboard for Claude Code API
-  version: 2.8.23
+  version: 2.8.25
  description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
  contact:
    name: Nguyễn Ngọc Trí Vĩ
@@ -2178,7 +2178,7 @@ components:
            type: string
          description: Command arguments — present only for `stdio` servers.
          example:
-            - '-y'
+            - -y
            - '@modelcontextprotocol/server-github'
        envNames:
          type: array
@@ -2340,7 +2340,7 @@ components:
        project:
          type: string
          description: 'Auto-memory only: the ~/.claude/projects/<slug> directory name the file belongs to.'
-          example: '-Users-son-repo'
+          example: -Users-son-repo
        name:
          type: string
          description: 'Auto-memory only: the markdown filename.'
@@ -2868,7 +2868,7 @@ components:
        project:
          type: string
          description: 'Required for `auto-memory`: the ~/.claude/projects/<slug> directory name. Validated against /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,255}$/ and rejected if it contains `..`.'
-          example: '-Users-son-repo'
+          example: -Users-son-repo
    CcConfigFileWriteResponse:
      type: object
      description: Result of a successful create-or-overwrite.
@@ -2933,7 +2933,7 @@ components:
        project:
          type: string
          description: 'Required for `auto-memory`: the projects/<slug> directory name.'
-          example: '-Users-son-repo'
+          example: -Users-son-repo
    CcConfigFileDeleteResponse:
      type: object
      description: Result of a successful delete (a mandatory backup is created first).
@@ -2984,7 +2984,7 @@ components:
        project:
          type: string
          description: 'Auto-memory only: the projects/<slug> directory name.'
-          example: '-Users-son-repo'
+          example: -Users-son-repo
        type:
          type: string
          enum:
@@ -4362,8 +4362,8 @@ components:
          items:
            type: string
          example:
-            - '-Users-son-code-foo'
-            - '-Users-son-code-bar'
+            - -Users-son-code-foo
+            - -Users-son-code-bar
    RemoteSourceSyncResponse:
      type: object
      description: Counters from a pull-now sync against the remote source.
@@ -8432,6 +8432,52 @@ paths:
            text/html:
              schema:
                type: string
+  /api/redoc/redoc.standalone.js:
+    get:
+      tags:
+        - Documentation
+      summary: ReDoc bundle
+      description: The ReDoc standalone script the `/api/redoc` page loads, sent from the server's own vendored copy (no CDN).
+      operationId: getRedocBundle
+      responses:
+        '200':
+          description: JavaScript bundle
+          content:
+            application/javascript:
+              schema:
+                type: string
+        '500':
+          description: The bundle could not be read
+  /api/cc-config/target:
+    get:
+      tags:
+        - CcConfig
+      summary: Whose Claude Code config this login manages
+      description: 'Server mode: `own` for a non-admin with their own Linux account (S3) — every other endpoint then reads and writes THEIR `~/.claude`, writes running as them; `host` for an admin (and in local mode), or an analyst''s read-only view of the host''s; `none` for a non-admin with no account (the other endpoints answer 403 ENOACCOUNT). Never an error.'
+      operationId: ccConfigGetTarget
+      responses:
+        '200':
+          description: The target.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  kind:
+                    type: string
+                    enum:
+                      - own
+                      - host
+                      - none
+                  readOnly:
+                    type: boolean
+                  claudeHome:
+                    type: string
+                    nullable: true
+              example:
+                kind: own
+                readOnly: false
+                claudeHome: /srv/agenthub/mia/.claude
  /api/cc-config/overview:
    get:
      tags:
@@ -8833,7 +8879,7 @@ paths:
                    kind: stdio
                    command: npx
                    args:
-                      - '-y'
+                      - -y
                      - '@modelcontextprotocol/server-github'
                    envNames:
                      - GITHUB_TOKEN
@@ -8892,7 +8938,7 @@ paths:
                  items:
                    type: string
                  example:
-                    - '-y'
+                    - -y
                    - server-github
                env:
                  type: object
@@ -9116,7 +9162,7 @@ paths:
                    truncated: false
                    preview: '# Workspace & Productivity System...'
                  - scope: auto-memory
-                    project: '-Users-son-repo'
+                    project: -Users-son-repo
                    name: MEMORY.md
                    isIndex: true
                    file: /Users/son/.claude/projects/-Users-son-repo/memory/MEMORY.md
@@ -13040,8 +13086,8 @@ paths:
                    ok: true
                    message: Connected; found 24 project directories under ~/.claude/projects.
                    remoteProjects:
-                      - '-Users-son-code-foo'
-                      - '-Users-son-code-bar'
+                      - -Users-son-code-foo
+                      - -Users-son-code-bar
                failure:
                  summary: Unreachable / auth failed
                  value:
@@ -15088,6 +15134,74 @@ paths:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
+    delete:
+      tags:
+        - Auth
+      operationId: deleteServerUser
+      summary: 'Admin (Delete user): the account for good — its logins, panes, workspaces'' records and prefs, and under S3 its Linux account and whole home, removed FIRST so a refusal leaves every row. Session history and the audit log stay. Never yourself (ESELF) or the last enabled admin (ELASTADMIN)'
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - currentPassword
+              properties:
+                currentPassword:
+                  type: string
+      responses:
+        '200':
+          description: Deleted — the account as it was
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  user:
+                    $ref: '#/components/schemas/AuthUser'
+        '400':
+          description: EBADPASSWORD / EBADROLE / EBADFIELD
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '403':
+          description: EREAUTH (own password wrong) / EADMIN / ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '404':
+          description: ENOUSER / ENOLANE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '409':
+          description: ESELF — yourself / ELASTADMIN — the last enabled admin
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '429':
+          description: ETOOMANY — 10 wrong passwords in 15 minutes
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '502':
+          description: EPROVISION — the Linux account or home could not be removed; nothing deleted
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
  /api/users/{id}/password:
    post:
      tags:
@@ -16979,16 +17093,17 @@ paths:
          description: 'The identity; `sshUsers: [{host, user, alias, key}]`.'
        '400':
          description: EBADHOST / EBADSSHUSER / EBADALIAS / ENOKEY
-  /api/me/git/ssh-user/{from}:
+  /api/me/git/ssh-user/{host}:
    delete:
      tags:
        - Git identity
      summary: Drop the SSH login of a host or alias (and its key link)
      operationId: deleteSshUser
      parameters:
-        - name: from
+        - name: host
          in: path
          required: true
+          description: The host or alias the login was saved under.
          schema:
            type: string
      responses:
@@ -20326,6 +20441,94 @@ paths:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
+  /api/run/clipboard-files:
+    post:
+      tags:
+        - Run
+      summary: The files a file manager's Copy put on this machine's clipboard
+      operationId: runClipboardFiles
+      description: 'For a browser on this machine: the files the OS clipboard holds (Windows GetFileDropList, macOS NSPasteboard file URLs, Linux text/uri-list via wl-paste/xclip), each that exists here with its size (`null` for a folder), at most 100 — so a pasted copy is attached by its own path, with no upload and no size limit. The client uses a path only when name and size match the pasted file. 403 EREMOTE in server mode or for any non-loopback (or proxied) request.'
+      responses:
+        '200':
+          description: The clipboard's files; empty when it holds none or no reader is installed.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  files:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        path:
+                          type: string
+                        size:
+                          type: integer
+                          nullable: true
+                        dir:
+                          type: boolean
+        '403':
+          description: EREMOTE.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /api/run/selected-files:
+    post:
+      tags:
+        - Run
+      summary: The files selected in this machine's file manager (what a drag carries)
+      operationId: runSelectedFiles
+      description: 'For a browser on this machine: the items selected in Explorer (every window, and the desktop) or Finder — a drag from the file manager carries exactly those — each that exists here with its size (`null` for a folder), at most 100, so a dropped file is attached by its own path with no upload and no size limit. Linux file managers publish no selection: always empty there. Nothing is searched for on disk. 403 EREMOTE in server mode or for any non-loopback (or proxied) request.'
+      responses:
+        '200':
+          description: The selected files; empty when none or no reader is available.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  files:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        path:
+                          type: string
+                        size:
+                          type: integer
+                          nullable: true
+                        dir:
+                          type: boolean
+        '403':
+          description: EREMOTE.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+  /api/run/native-paste:
+    get:
+      tags:
+        - Run
+      summary: Whether a claude pane can read this machine's clipboard itself
+      operationId: runNativePaste
+      description: '`native`: local mode, a loopback request, and on Linux a reachable display plus `wl-paste` or `xclip` — then the terminal hands a pasted screenshot to `claude` as its image-paste key instead of uploading it. `key`: that chord on this machine — `alt+v` on Windows, `ctrl+v` elsewhere (Claude Code''s own bindings).'
+      responses:
+        '200':
+          description: The answer.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  native:
+                    type: boolean
+                  key:
+                    type: string
+                    enum:
+                      - ctrl+v
+                      - alt+v
  /api/run/interrupted:
    get:
      tags:
@@ -1,6 +1,6 @@
 {
  "name": "agenthub",
-  "version": "2.8.23",
+  "version": "2.8.26",
  "bin": {
    "agenthub": "bin/agenthub.js"
  },
@@ -71,21 +71,20 @@
    "link-cli": "npm link || node -e \"console.warn('agenthub CLI not linked globally (no permission?). Link manually with: npm link')\""
  },
  "dependencies": {
-    "@lydell/node-pty": "^1.2.0-beta.15",
+    "@lydell/node-pty": "^1.2.0-beta.18",
    "adm-zip": "^0.6.1",
    "cors": "^2.8.5",
-    "express": "^4.21.2",
-    "js-yaml": "^4.1.0",
-    "multer": "^2.0.0",
+    "express": "^5.3.0",
+    "js-yaml": "^5.5.0",
+    "multer": "^2.5.0",
    "swagger-ui-express": "^5.0.1",
    "systray2": "^2.1.4",
    "tar": "^7.4.3",
-    "uuid": "^11.1.0",
    "web-push": "^3.6.7",
    "ws": "^8.18.0"
  },
  "optionalDependencies": {
-    "better-sqlite3": "^12.0.0"
+    "better-sqlite3": "^13.0.3"
  },
  "devDependencies": {
    "concurrently": "^9.1.2",
@@ -239,7 +239,7 @@ function systemdStatus() {
 /**
 * WARN (never FAIL) when `tmux` is absent: every run the dashboard starts is a
 * tmux session (`server/lib/tmux.js`), so without the binary the run console,
- * `agenthub lanes shell` and the session-reload keystrokes all fail — while
+ * `agenthub workspace shell` and the session-reload keystrokes all fail — while
 * sessions, analytics, lanes and the CLI keep working. A partial feature
 * loss must not fail a doctor run.
 *
@@ -26,7 +26,7 @@
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

-const { v4: uuidv4 } = require("uuid");
+const { randomUUID: uuidv4 } = require("crypto");
 const { db, stmts } = require("../server/db");

 // ── Stable fixture IDs ─────────────────────────────────────────────────────
@@ -51,14 +51,12 @@ const env = {
  // No suite may fetch LiteLLM's price list (reset-pricing syncs at once).
  AGENTHUB_PRICING_SYNC: "0",
  // Nor run the developer's real agy (it may update itself) or send their
-  // real Cursor, Grok, Kimi or OpenCode login for the quota.
+  // real Cursor login for the quota.
  AGENTHUB_AGY_USAGE: "0",
  // Nor refresh (spend) a real Claude pool login: its refresh token is single use.
  DASHBOARD_POOL_REFRESH_MS: "0",
  XDG_CONFIG_HOME: tmuxDir,
  XDG_DATA_HOME: tmuxDir,
-  GROK_HOME: tmuxDir,
-  KIMI_CODE_HOME: tmuxDir,
  DASHBOARD_PIPELINES_DIR: path.join(dir, "fixtures", "pipelines"),
  // Never this machine's server-mode S3 install: its system unit would become
  // "the" service manager and its server.conf would send user changes to sudo.
@@ -441,7 +441,7 @@ All endpoints return JSON unless noted. Error responses use:
 | `GET`  | `/api/redoc`                     | **ReDoc** reference — clean, read-optimized three-panel rendering of the same spec   |
 | `GET`  | `/api/redoc/redoc.standalone.js` | Self-hosted ReDoc bundle (vendored in `server/vendor/redoc/`, never a CDN — works offline) |

-The OpenAPI spec is generated from `server/openapi.js` (`createOpenApiSpec()`), merged with supplementary fragments under `server/openapi-extra/`, and is the source of truth for request/response contracts. It now documents every backend route (75 path entries). Both Swagger UI and ReDoc (`server/lib/redoc.js`) render the same spec; the ReDoc bundle is served locally so the reference works offline / air-gapped. A committed `openapi.yaml` at the repo root mirrors the live spec — regenerate it after API changes with `npm run openapi:yaml` (never hand-edit it).
+The OpenAPI spec is generated from `server/openapi.js` (`createOpenApiSpec()`), merged with supplementary fragments under `server/openapi-extra/`, and is the source of truth for request/response contracts. It documents every `/api` route (332 paths, 399 operations); `server/__tests__/openapi-coverage.test.js` fails when a registered route has no operation in the spec, or an operation has no route (the `/api/workspaces` and `/api/ai-routers` alias mounts are documented once, under `/api/lanes` and `/api/ai-proxies`). Both Swagger UI and ReDoc (`server/lib/redoc.js`) render the same spec; the ReDoc bundle is served locally so the reference works offline / air-gapped. A committed `openapi.yaml` at the repo root mirrors the live spec — regenerate it after API changes with `npm run openapi:yaml` (never hand-edit it).

 ### Core Endpoints

@@ -655,23 +655,12 @@ An `antigravity` workspace carries no pipeline either.
  what it said so far; `GET /api/sessions/:id/transcript(s)` reads an omp
  session's journals from there. Under S3 each member's `~/.omp` is read only
  through `openSafeAsync`.
- **OpenCode sessions:** `server/lib/opencode-usage.js` reads OpenCode's
-  SQLite store (`~/.local/share/opencode/opencode.db`, under `XDG_DATA_HOME`
-  when set) every `DASHBOARD_OPENCODE_POLL_MS` ms (default 15000, `0`
-  disables), when its file or WAL changed: each root `session` row becomes a
-  `sessions` row (`tool = 'opencode'`), its tree's assistant `message` tokens
-  per `modelID` become `token_usage` (reasoning counted as output), and each
-  child session (the `task` tool's) an `opencode-<id>` subagent row.
-  `opencode_stores` holds each store's mtime and `opencode_sessions` each root
-  session's newest `time_updated`; the transcript routes read the conversation
-  (messages + parts) from the store itself. A member's store and WAL are copied
-  through the guard before they are opened.
- **Grok sessions:** Grok runs the hooks in `~/.claude/settings.json` (its
-  Claude compatibility), so AgentHub's own hook reaches `POST /api/hooks/event`
-  with no `tool`; `routes/hooks.js` tells it apart by the camelCase keys only
-  Grok sends (`hookEventName` + `workspaceRoot`), records it as `tool = 'grok'`
-  and drops its `transcript_path` (Grok's file, never parsed as a Claude
-  transcript). No tokens: Grok's session files are not read.
+- **Grok hooks:** Grok is not an AgentHub tool, but it runs the hooks in
+  `~/.claude/settings.json` (its Claude compatibility), so AgentHub's own hook
+  can still reach `POST /api/hooks/event` with no `tool`; `routes/hooks.js`
+  tells it apart by the camelCase keys only Grok sends (`hookEventName` +
+  `workspaceRoot`) and drops it, rather than record a Claude session whose
+  `transcript_path` is Grok's file.
 - **Quiet sessions:** agy fires no exit hook, so a session quiet for ten
  minutes (with hook events) or two (without) is settled to `completed`, its
  agents too, and sets its workspace idle. That workspace must be one the hooks left
@@ -758,10 +747,11 @@ Because sync runs non-interactively (`ssh -o BatchMode=yes`), the connection mus

 ### Claude Config Explorer (`/api/cc-config`)

-Reads — and carefully gated mutations for low-risk text-file artifacts — for every Claude Code configuration surface. Mutations always create timestamped backups under `<root>/cc-config-backups/<type>/` before writing.
+Reads — and carefully gated mutations for low-risk text-file artifacts — for every Claude Code configuration surface. Mutations always create timestamped backups under `<root>/cc-config-backups/<type>/` before writing. In server mode the router gates itself (`lib/cc-target.js`): an admin works on the host's Claude home, a non-admin with their own Linux account (S3) on THEIR `~/.claude` (writes as them through `write-as` / sudo `claude`), anyone else gets `403 ENOACCOUNT`; `/profiles*` and `/plugins/update-all` stay an admin's. See `docs/SERVER-MODE.md` → "Your own Claude Code config".

 | Method   | Path                                  | Description |
 | -------- | ------------------------------------- | ----------- |
+| `GET`    | `/api/cc-config/target`               | Whose config this login manages: `own` / `host` / `none` |
 | `GET`    | `/api/cc-config/overview`             | Roots + counts for every surface (used by the Overview tab) |
 | `GET`    | `/api/cc-config/skills`               | Skills with parsed frontmatter, `?scope=user\|project\|all` |
 | `GET`    | `/api/cc-config/agents`               | Subagents under `<scope>/.claude/agents/*.md` |
@@ -0,0 +1,167 @@
+/**
+ * @file Tests for server/lib/agent-edits.js (issue #86): the files a
+ * subagent wrote or edited are read from its own transcript — +/- lines from
+ * `structuredPatch` or a created file's content, a failed call left out, a
+ * nested subagent folded in — and put on the parent's Agent result as `edits`;
+ * and `turnCarry` hands a page of the chat the edits its cut-off first turn
+ * made before the page began.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const HOME = fs.mkdtempSync(path.join(os.tmpdir(), "agent-edits-"));
+process.env.CLAUDE_HOME = HOME;
+
+const { encodeCwd } = require("../lib/claude-home");
+const { agentEdits, attachAgentEdits, turnCarry, _cache } = require("../lib/agent-edits");
+
+const CWD = "/work/repo";
+const SID = "11111111-2222-3333-4444-555555555555";
+const subDir = path.join(HOME, "projects", encodeCwd(CWD), SID, "subagents");
+
+const call = (id, name, input) => ({
+  type: "assistant",
+  message: { content: [{ type: "tool_use", id, name, input }] },
+});
+const result = (id, toolUseResult, isError = false) => ({
+  type: "user",
+  message: { content: [{ type: "tool_result", tool_use_id: id, is_error: isError }] },
+  toolUseResult,
+});
+const write = (agentId, lines) =>
+  fs.writeFileSync(
+    path.join(subDir, `agent-${agentId}.jsonl`),
+    lines.map((l) => JSON.stringify(l)).join("\n")
+  );
+
+before(() => {
+  fs.mkdirSync(subDir, { recursive: true });
+  write("a1", [
+    call("t1", "Edit", { file_path: "/work/repo/main.go" }),
+    result("t1", { structuredPatch: [{ lines: [" x", "-old", "+new", "+more"] }] }),
+    call("t2", "Write", { file_path: "/work/repo/new_test.go" }),
+    result("t2", { type: "create", content: "a\nb\nc\n" }),
+    call("t3", "Edit", { file_path: "/work/repo/broken.go" }),
+    result("t3", "String to replace not found", true),
+    call("t4", "Agent", { prompt: "go deeper" }),
+    result("t4", { agentId: "a2", status: "completed" }),
+  ]);
+  write("a2", [
+    call("u1", "Edit", { file_path: "/work/repo/main.go" }),
+    result("u1", { structuredPatch: [{ lines: ["+x"] }] }),
+    call("u2", "Bash", { command: "go test ./..." }),
+    result("u2", { stdout: "ok" }),
+  ]);
+});
+after(() => fs.rmSync(HOME, { recursive: true, force: true }));
+
+describe("agentEdits", () => {
+  it("lists a subagent's files with their lines, nested subagents folded in", async () => {
+    const edits = await agentEdits(SID, CWD, "a1");
+    assert.deepEqual(edits, [
+      { path: "/work/repo/main.go", added: 3, removed: 1, counted: true },
+      { path: "/work/repo/new_test.go", added: 3, removed: 0, counted: true },
+    ]);
+  });
+
+  it("answers an empty list for a subagent with no transcript", async () => {
+    assert.deepEqual(await agentEdits(SID, CWD, "nope"), []);
+  });
+
+  it("reads a transcript again only after it changed", async () => {
+    await agentEdits(SID, CWD, "a2");
+    const file = path.join(subDir, "agent-a2.jsonl");
+    const before = _cache.get(file);
+    await agentEdits(SID, CWD, "a2");
+    assert.equal(_cache.get(file), before);
+    fs.appendFileSync(
+      file,
+      "\n" +
+        [
+          call("u3", "Write", { file_path: "/work/repo/late.go" }),
+          result("u3", { type: "create", content: "z\n" }),
+        ]
+          .map((l) => JSON.stringify(l))
+          .join("\n")
+    );
+    const edits = await agentEdits(SID, CWD, "a2");
+    assert.ok(edits.some((e) => e.path === "/work/repo/late.go"));
+  });
+});
+
+describe("attachAgentEdits", () => {
+  it("puts edits on an Agent result only", async () => {
+    const messages = [
+      {
+        content: [
+          { type: "tool_result", id: "t9", agent: { id: "a1" } },
+          { type: "tool_result", id: "t8", diff: { added: 1, removed: 0 } },
+          { type: "tool_result", id: "t7", agent: { id: "a1" }, is_error: true },
+        ],
+      },
+    ];
+    await attachAgentEdits(messages, SID, CWD);
+    const [ok, plain, failed] = messages[0].content;
+    assert.ok(ok.edits.some((e) => e.path === "/work/repo/new_test.go"));
+    assert.equal(plain.edits, undefined);
+    assert.equal(failed.edits, undefined);
+  });
+});
+
+describe("turnCarry", () => {
+  const prompt = (text) => ({ type: "user", sender: "user", content: [{ type: "text", text }] });
+  const use = (id, name, file_path) => ({
+    type: "assistant",
+    sender: "assistant",
+    content: [{ type: "tool_use", id, name, input: file_path ? { file_path } : {} }],
+  });
+  const res = (id, extra = {}) => ({
+    type: "user",
+    sender: "tool",
+    content: [{ type: "tool_result", id, ...extra }],
+  });
+
+  it("answers the files the cut-off turn changed before the page", async () => {
+    const c = turnCarry();
+    for (const m of [
+      prompt("old turn"),
+      use("o1", "Write", "/w/old.go"),
+      res("o1", { diff: { added: 9, removed: 0 } }),
+      prompt("this turn"),
+      use("1", "Write", "/w/a_test.go"),
+      res("1", { diff: { added: 176, removed: 0 } }),
+      use("2", "Edit", "/w/bad.go"),
+      res("2", { is_error: true }),
+      use("3", "Edit", "/w/b.go"),
+    ])
+      c.drop(m);
+    // The page: the result of a dropped call, then more of the same turn.
+    const page = [res("3", { diff: { added: 2, removed: 1 } }), use("4", "Write", "/w/c.go")];
+    assert.deepEqual(await c.result(page, SID, CWD), [
+      { path: "/w/a_test.go", added: 176, removed: 0, counted: true },
+      { path: "/w/b.go", added: 2, removed: 1, counted: true },
+    ]);
+  });
+
+  it("answers null when the page starts on a prompt", async () => {
+    const c = turnCarry();
+    c.drop(prompt("p"));
+    c.drop(use("1", "Write", "/w/a.go"));
+    c.drop(res("1", { diff: { added: 1, removed: 0 } }));
+    assert.equal(await c.result([prompt("next")], SID, CWD), null);
+  });
+
+  it("folds in a dropped subagent's own edits", async () => {
+    const c = turnCarry();
+    c.drop(prompt("p"));
+    c.drop(use("9", "Agent"));
+    c.drop(res("9", { agent: { id: "a1" } }));
+    const got = await c.result([use("10", "Bash")], SID, CWD);
+    assert.ok(got.some((e) => e.path === "/work/repo/new_test.go"));
+  });
+});
@@ -45,7 +45,7 @@ before(async () => {
    builtin,
    tool("gem", [
      { path: "~/.gem/settings.json" },
-      { path: "~/.gem/opencode.jsonc" },
+      { path: "~/.gem/tool.jsonc" },
      { path: "~/.gem/GEMINI.md" },
      { path: "~/.gem/missing.json" },
    ])
@@ -57,7 +57,7 @@ before(async () => {

  fs.mkdirSync(path.join(home, ".gem"));
  fs.writeFileSync(path.join(home, ".gem/settings.json"), '{"theme":"dark"}\n', { mode: 0o600 });
-  fs.writeFileSync(path.join(home, ".gem/opencode.jsonc"), '{\n  // c\n  "a": 1,\n}\n');
+  fs.writeFileSync(path.join(home, ".gem/tool.jsonc"), '{\n  // c\n  "a": 1,\n}\n');
  fs.writeFileSync(path.join(home, ".gem/GEMINI.md"), "# rules\n");

  const express = require("express");
@@ -109,6 +109,13 @@ before(async () => {
    })
  );
  write("selfy.json", tool("selfy", { update: { kind: "self", args: ["update", "--yes"] } }));
+  write(
+    "selfnpm.json",
+    tool("selfnpm", {
+      install: { kind: "npm", package: "selfnpm-pkg" },
+      update: { kind: "self", args: ["update"] },
+    })
+  );
  write("plain.json", tool("plain"));
  exe(path.join(shellBin, "npm"));
  exe(path.join(serverBin, "npm"));
@@ -241,6 +248,30 @@ describe("a system-wide npm prefix", () => {
      aiTools.refresh();
    }
  });
+
+  it("updates an npm tool with its own updater under ~/.local through npm --prefix", async () => {
+    const pkg = path.join(user, "lib", "node_modules", "selfnpm-pkg", "cli.js");
+    exe(pkg);
+    fs.symlinkSync(pkg, path.join(serverBin, "selfnpm"));
+    aiTools.refresh();
+    try {
+      assert.deepEqual(await jobs.stepsFor("selfnpm", "update"), [
+        {
+          argv: [
+            path.join(shellBin, "npm"),
+            "install",
+            "-g",
+            "--prefix",
+            user,
+            "selfnpm-pkg@latest",
+          ],
+        },
+      ]);
+    } finally {
+      fs.rmSync(path.join(serverBin, "selfnpm"));
+      aiTools.refresh();
+    }
+  });
 });

 describe("versions", () => {
@@ -26,8 +26,28 @@ for (const name of ["claude", "agy", "npm"]) {
 const origPath = process.env.PATH;
 process.env.PATH = BIN;

+// An npm-installed tool, in the release-synced tier (only a release catalog may
+// name an installer): no built-in tool updates through npm.
+const REMOTE = path.join(ROOT, "remote-catalog");
+fs.mkdirSync(REMOTE);
+fs.writeFileSync(
+  path.join(REMOTE, "npmtool.json"),
+  JSON.stringify({
+    id: "npmtool",
+    label: "npm tool",
+    detect: ["npmtool"],
+    prompt: { mode: "flag", flag: "--prompt" },
+    install: { kind: "npm", package: "npmtool" },
+    update: { kind: "npm" },
+  })
+);
+
 const { createApp } = require("../index");
-require("../lib/ai-tools").refresh();
+require("../lib/ai-tools").__setCatalogDirs([
+  path.join(__dirname, "..", "data", "ai-tools"),
+  REMOTE,
+  path.join(ROOT, "custom-catalog"),
+]);

 let app;
 let base;
@@ -59,7 +79,7 @@ describe("/api/ai-tools", () => {
    assert.equal(agy.path, path.join(BIN, "agy"));
    assert.equal(agy.resume, true);
    assert.equal(agy.bypass, true);
-    assert.equal(body.tools.find((t) => t.id === "opencode").installed, false);
+    assert.equal(body.tools.find((t) => t.id === "npmtool").installed, false);
    assert.equal("args" in agy, false);
  });

@@ -76,7 +96,7 @@ describe("/api/ai-tools", () => {

  it("answers ENOTOOL / EBADDEFAULT / EBADFIELD", async () => {
    assert.equal((await request("PUT", "/api/ai-tools/nope", { enabled: false })).status, 404);
-    const bad = await request("PUT", "/api/ai-tools/opencode", { default: true });
+    const bad = await request("PUT", "/api/ai-tools/npmtool", { default: true });
    assert.equal(bad.status, 400);
    assert.equal(bad.body.error.code, "EBADDEFAULT");
    assert.equal((await request("PUT", "/api/ai-tools/claude", { enabled: "no" })).status, 400);
@@ -112,10 +132,10 @@ describe("/api/ai-tools", () => {
  });

  it("refresh re-detects", async () => {
-    fs.writeFileSync(path.join(BIN, "opencode"), "#!/bin/sh\n");
-    fs.chmodSync(path.join(BIN, "opencode"), 0o755);
+    fs.writeFileSync(path.join(BIN, "npmtool"), "#!/bin/sh\n");
+    fs.chmodSync(path.join(BIN, "npmtool"), 0o755);
    const r = await request("POST", "/api/ai-tools/refresh");
-    assert.equal(r.body.tools.find((t) => t.id === "opencode").installed, true);
+    assert.equal(r.body.tools.find((t) => t.id === "npmtool").installed, true);
  });

  it("/api/run/binary resolves through the catalog", async () => {
@@ -132,9 +152,9 @@ describe("lanes on catalog tools", () => {
      fs.mkdirSync(d, { recursive: true });
      return d;
    };
-    let r = await request("POST", "/api/lanes", { cwd: dir("a"), title: "a", tool: "opencode" });
+    let r = await request("POST", "/api/lanes", { cwd: dir("a"), title: "a", tool: "npmtool" });
    assert.equal(r.status, 201);
-    assert.equal(r.body.lane.tool, "opencode");
+    assert.equal(r.body.lane.tool, "npmtool");
    r = await request("POST", "/api/lanes", { cwd: dir("b"), title: "b", tool: "omp" });
    assert.equal(r.status, 201, "a tool that is not installed may still get a lane");
    r = await request("POST", "/api/lanes", { cwd: dir("c"), title: "c", tool: "nope" });
@@ -212,8 +232,8 @@ describe("install / update / icons", () => {
    const notInstalled = await request("POST", "/api/ai-tools/codex/update");
    assert.equal(notInstalled.status, 409);
    assert.equal(notInstalled.body.error.code, "ENOTINSTALLED");
-    // opencode was put on PATH by the refresh test, outside any npm prefix.
-    const notNpm = await request("POST", "/api/ai-tools/opencode/update");
+    // npmtool was put on PATH by the refresh test, outside any npm prefix.
+    const notNpm = await request("POST", "/api/ai-tools/npmtool/update");
    assert.equal(notNpm.status, 409);
    assert.equal(notNpm.body.error.code, "ENOTNPM");
    const cross = await request("POST", "/api/ai-tools/codex/install", undefined, {
@@ -241,7 +261,7 @@ describe("install / update / icons", () => {
    assert.deepEqual(spawned.at(-1), [path.join(BIN, "claude"), "update"]);
    const v = await request("GET", "/api/ai-tools/versions");
    assert.equal(v.status, 200);
-    assert.equal(v.body.opencode.npmManaged, false);
+    assert.equal(v.body.npmtool.npmManaged, false);
  });

  it("update-all answers ENOTHING when nothing has an update", async () => {
@@ -10,8 +10,10 @@
 * junk skipped, nothing stored when one fails) or written in the dialog, a
 * file uploaded, sharing refused in local mode, visibility for a server-mode
 * developer, the admin's installs switch, same-origin writes, Claude Docs
- * docs captured at their birth, documents captured at a session's stop, and
- * unowned rows claimed, declined and assigned.
+ * docs captured at their birth, documents captured at a session's stop,
+ * unowned rows claimed, declined and assigned, and a skill that follows its
+ * source folder (a newer change wins over a Hub edit) with Update offered to
+ * an installed copy that differs.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -338,6 +340,69 @@ describe("skills", () => {
    assert.equal(empty.status, 400);
  });

+  it("follows its source folder and offers Update to an installed copy", async () => {
+    const src = path.join(ws, ".claude", "skills", "notes");
+    fs.mkdirSync(src, { recursive: true });
+    fs.writeFileSync(path.join(src, "SKILL.md"), "---\nname: notes\ndescription: v1\n---\nOne.\n");
+    const r = await request("POST", "/api/artifacts/skill", { laneId: lane.id, name: "notes" });
+    assert.equal(r.status, 201, r.text);
+    const id = r.body.item.id;
+    const listed = async () =>
+      (await request("GET", "/api/artifacts?kind=skill")).body.items.find((i) => i.id === id);
+    const raw = async () => (await request("GET", `/api/artifacts/${id}/raw?path=SKILL.md`)).text;
+    assert.equal((await request("POST", `/api/artifacts/${id}/install`, {})).status, 200);
+    let item = await listed();
+    assert.equal(item.installed, true);
+    assert.equal(item.updateAvailable, false);
+    const installs = item.installs;
+
+    // Unchanged folder: nothing taken.
+    assert.deepEqual(artifacts.syncSkillSources({ force: true }), []);
+    // The owner changes it: a new snapshot, and the installed copy is behind.
+    const snapBefore = db.prepare("SELECT snapshot FROM artifacts WHERE id = ?").get(id).snapshot;
+    fs.writeFileSync(path.join(src, "SKILL.md"), "---\nname: notes\ndescription: v2\n---\nTwo.\n");
+    fs.writeFileSync(path.join(src, "extra.md"), "more\n");
+    const changed = artifacts.syncSkillSources({ force: true });
+    assert.deepEqual(
+      changed.map((c) => c.id),
+      [id]
+    );
+    assert.match(await raw(), /Two\./);
+    assert.ok(!fs.existsSync(path.join(process.env.DASHBOARD_DATA_DIR, "artifacts", snapBefore)));
+    item = await listed();
+    assert.equal(item.description, "v2");
+    assert.ok(item.files.some((f) => f.path === "extra.md"));
+    assert.equal(item.updateAvailable, true);
+
+    // Update: the copy is replaced (old one moved aside), not counted again.
+    const up = await request("POST", `/api/artifacts/${id}/install`, { update: true });
+    assert.equal(up.status, 200, up.text);
+    const target = path.join(process.env.CLAUDE_HOME, "skills", "notes");
+    assert.match(fs.readFileSync(path.join(target, "SKILL.md"), "utf8"), /Two\./);
+    item = await listed();
+    assert.equal(item.updateAvailable, false);
+    assert.equal(item.installs, installs);
+
+    // A Hub edit is not undone by the unchanged folder; a newer folder change wins.
+    const edit = await request("PATCH", `/api/artifacts/${id}`, {
+      skill: { name: "notes", description: "hub", content: "Edited in the Hub." },
+    });
+    assert.equal(edit.status, 200, edit.text);
+    artifacts.syncSkillSources({ force: true });
+    assert.match(await raw(), /Edited in the Hub\./);
+    fs.writeFileSync(
+      path.join(src, "SKILL.md"),
+      "---\nname: notes\ndescription: v3\n---\nThree.\n"
+    );
+    artifacts.syncSkillSources({ force: true });
+    assert.match(await raw(), /Three\./);
+
+    // Update needs an installed copy.
+    await request("POST", `/api/artifacts/${id}/uninstall`, {});
+    const none = await request("POST", `/api/artifacts/${id}/install`, { update: true });
+    assert.equal(none.body.error.code, "ENOTINSTALLED");
+  });
+
  it("refuses a skill holding a symlink or a secret-looking file", async () => {
    const bad = path.join(ws, ".claude", "skills", "leaky");
    fs.mkdirSync(bad, { recursive: true });
@@ -98,6 +98,17 @@ describe("reloadableLanes", () => {
    stubTmux([]);
    assert.deepEqual(reloadableLanes(), []);
  });
+
+  it("keeps the host's panes and one member's apart (S3)", (t) => {
+    stubTmux(["agenthub-lane-1", "agenthub-lane-2", "agenthub-lane-3"]);
+    const owners = { "agenthub-lane-2": { name: "mia" }, "agenthub-lane-3": { name: "bob" } };
+    t.mock.method(require("../lib/run-as"), "accountForSession", (id) => owners[id] || null);
+    const ids = (list) => list.map((l) => l.id);
+    // The host's reload never types into a member's pane…
+    assert.deepEqual(ids(reloadableLanes()), ["agenthub-lane-1"]);
+    // …and a member's reaches their own panes only.
+    assert.deepEqual(ids(reloadableLanes({ name: "mia" })), ["agenthub-lane-2"]);
+  });
 });

 describe("reloadOpenSessions", () => {
@@ -8,7 +8,7 @@
 */
 const { describe, it, beforeEach, afterEach } = require("node:test");
 const assert = require("node:assert/strict");
-const { desktopEnv, FORWARDED, __setExecImpl } = require("../lib/desktop-env");
+const { desktopEnv, canReadClipboard, FORWARDED, __setExecImpl } = require("../lib/desktop-env");

 const saved = {};

@@ -61,3 +61,30 @@ describe("desktopEnv", () => {
    assert.equal(desktopEnv().WAYLAND_DISPLAY, undefined);
  });
 });
+
+describe("canReadClipboard", () => {
+  const has =
+    (...names) =>
+    (n) =>
+      names.includes(n) ? `/usr/bin/${n}` : null;
+
+  it("needs wl-paste for a Wayland display, xclip for an X one", () => {
+    const wl = { WAYLAND_DISPLAY: "wayland-0" };
+    const x = { DISPLAY: ":0" };
+    assert.equal(canReadClipboard({ platform: "linux", env: wl, which: has("wl-paste") }), true);
+    assert.equal(canReadClipboard({ platform: "linux", env: wl, which: has("xclip") }), false);
+    assert.equal(canReadClipboard({ platform: "linux", env: x, which: has("xclip") }), true);
+    assert.equal(canReadClipboard({ platform: "linux", env: x, which: has() }), false);
+  });
+
+  it("is false with no display at all — a headless box", () => {
+    assert.equal(
+      canReadClipboard({ platform: "linux", env: {}, which: has("xclip", "wl-paste") }),
+      false
+    );
+  });
+
+  it("is true off Linux, where the clipboard tools are built in", () => {
+    assert.equal(canReadClipboard({ platform: "darwin", env: {}, which: has() }), true);
+  });
+});
@@ -0,0 +1,124 @@
+/**
+ * @file file-manager.test.js
+ * @description server/lib/file-manager.js: the files a file manager's Copy
+ * put on the OS clipboard (Windows GetFileDropList, macOS NSPasteboard, Linux
+ * text/uri-list / gnome-copied-files) and the ones selected in it — what a
+ * drag carries (Windows Shell.Application, macOS Finder) — kept only when
+ * they exist here, with their sizes; a missing reader is no files.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+const { describe, it, before, after, afterEach } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const {
+  clipboardFiles,
+  selectedFiles,
+  uriListPaths,
+  __setExecImpl,
+} = require("../lib/file-manager");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "fm-files-"));
+const big = path.join(TMP, "big file.mp4");
+const dir = path.join(TMP, "folder");
+
+before(() => {
+  fs.writeFileSync(big, Buffer.alloc(1234));
+  fs.mkdirSync(dir);
+});
+after(() => fs.rmSync(TMP, { recursive: true, force: true }));
+afterEach(() => __setExecImpl(async () => ""));
+
+describe("uriListPaths", () => {
+  it("decodes file URIs and skips a gnome list's verb, comments and other hosts", () => {
+    assert.deepEqual(
+      uriListPaths("copy\nfile:///home/u/a%20b.png\r\n# c\nfile://other/x\nhttps://x/y\n"),
+      ["/home/u/a b.png"]
+    );
+  });
+});
+
+describe("clipboardFiles", () => {
+  it("reads Windows' file drop list with powershell -Sta", async () => {
+    let seen;
+    __setExecImpl(async (cmd, args) => {
+      seen = [cmd, args];
+      return `${big}\r\n${dir}\r\n${path.join(TMP, "gone.txt")}\r\n`;
+    });
+    assert.deepEqual(await clipboardFiles("win32"), [
+      { path: big, size: 1234, dir: false },
+      { path: dir, size: null, dir: true },
+    ]);
+    assert.equal(seen[0], "powershell");
+    assert.ok(seen[1].includes("-Sta"));
+    assert.match(seen[1].at(-1), /GetFileDropList/);
+  });
+
+  it("reads macOS file URLs through JXA", async () => {
+    let seen;
+    __setExecImpl(async (cmd, args) => {
+      seen = [cmd, args];
+      return `${big}\n`;
+    });
+    assert.deepEqual(await clipboardFiles("darwin"), [{ path: big, size: 1234, dir: false }]);
+    assert.equal(seen[0], "osascript");
+    assert.deepEqual(seen[1].slice(0, 2), ["-l", "JavaScript"]);
+  });
+
+  it("reads Linux text/uri-list with the desktop's display", async () => {
+    const saved = process.env.DISPLAY;
+    process.env.DISPLAY = ":0";
+    try {
+      const calls = [];
+      __setExecImpl(async (cmd, args, env) => {
+        calls.push([cmd, args.join(" "), env.DISPLAY]);
+        return cmd === "xclip" ? `file://${encodeURI(big)}\n` : "";
+      });
+      assert.deepEqual(await clipboardFiles("linux"), [{ path: big, size: 1234, dir: false }]);
+      assert.deepEqual(calls.at(-1), ["xclip", "-selection clipboard -t text/uri-list -o", ":0"]);
+    } finally {
+      if (saved === undefined) delete process.env.DISPLAY;
+      else process.env.DISPLAY = saved;
+    }
+  });
+
+  it("answers no files when the reader is missing or prints relative paths", async () => {
+    __setExecImpl(async () => "");
+    assert.deepEqual(await clipboardFiles("win32"), []);
+    __setExecImpl(async () => "relative/x.txt\n");
+    assert.deepEqual(await clipboardFiles("darwin"), []);
+  });
+
+  it("reads Explorer's selection (and the desktop's) for a drop, once per path", async () => {
+    let seen;
+    __setExecImpl(async (cmd, args) => {
+      seen = [cmd, args];
+      return `${big}\r\n${big}\r\n`;
+    });
+    assert.deepEqual(await selectedFiles("win32"), [{ path: big, size: 1234, dir: false }]);
+    assert.equal(seen[0], "powershell");
+    assert.match(seen[1].at(-1), /Shell\.Application[\s\S]*SelectedItems[\s\S]*FindWindowSW/);
+  });
+
+  it("reads Finder's selection on macOS, a folder with its trailing slash", async () => {
+    let seen;
+    __setExecImpl(async (cmd, args) => {
+      seen = [cmd, args];
+      return `${dir}/\n`;
+    });
+    assert.deepEqual(await selectedFiles("darwin"), [{ path: `${dir}/`, size: null, dir: true }]);
+    assert.equal(seen[0], "osascript");
+    assert.ok(seen[1].includes("repeat with a in (selection as alias list)"));
+  });
+
+  it("has no selection to read on Linux", async () => {
+    let called = false;
+    __setExecImpl(async () => {
+      called = true;
+      return big;
+    });
+    assert.deepEqual(await selectedFiles("linux"), []);
+    assert.equal(called, false);
+  });
+});
@@ -1,7 +1,7 @@
 {
-  "id": "grok",
-  "label": "Grok",
-  "detect": ["grok"],
+  "id": "septool",
+  "label": "Separator tool",
+  "detect": ["septool"],
  "prompt": {
    "mode": "argv",
    "separator": "--"
@@ -1,32 +1,34 @@
 /**
 * @file fake-sudo.js
 * @description Test helper for the S3 suites: an `execImpl` for
- * `run-as.__setExecImpl` that plays `sudo -n -u <login> [VAR=v…] <bin> …`
- * without root — it records the argv (so a test can assert nothing secret
+ * `run-as.__setExecImpl` (and a `spawn` for `__setSpawnImpl`) that plays
+ * `sudo -n -u <login> [VAR=v…] <bin> …` without root — it records the argv (so a test can assert nothing secret
 * crossed sudo) and runs the real `scripts/server/write-as.sh` for
 * `/opt/agenthub/libexec/write-as`, as this account.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

 const path = require("node:path");
-const { execFileSync } = require("node:child_process");
+const { execFileSync, spawn: spawnChild } = require("node:child_process");

 const WRITE_AS = path.join(__dirname, "..", "..", "..", "scripts", "server", "write-as.sh");

-/** `{ exec, calls }`: pass `exec` to `runAs.__setExecImpl`; `calls` = every sudo argv. */
+/** `{ exec, spawn, calls }`: pass `exec` to `runAs.__setExecImpl` and `spawn`
+ *  to `runAs.__setSpawnImpl`; `calls` = every sudo argv. */
 function fakeSudo() {
  const calls = [];
-  const exec = (cmd, argv, opts = {}) => {
+  // The command sudo would run, as [file, args].
+  const unwrap = (cmd, argv) => {
    calls.push([cmd, ...argv]);
-    if (cmd !== "sudo") return execFileSync(cmd, argv, opts);
+    if (cmd !== "sudo") return [cmd, argv];
    let i = argv.indexOf("-u") + 2; // past the login
    while (/^[A-Z_][A-Z0-9_]*=/.test(argv[i])) i++;
    const [bin, ...rest] = argv.slice(i);
-    if (bin === "/opt/agenthub/libexec/write-as")
-      return execFileSync("sh", [WRITE_AS, ...rest], opts);
-    return execFileSync(bin, rest, opts);
+    return bin === "/opt/agenthub/libexec/write-as" ? ["sh", [WRITE_AS, ...rest]] : [bin, rest];
  };
-  return { exec, calls };
+  const exec = (cmd, argv, opts = {}) => execFileSync(...unwrap(cmd, argv), opts);
+  const spawn = (cmd, argv, opts = {}) => spawnChild(...unwrap(cmd, argv), opts);
+  return { exec, spawn, calls };
 }

 module.exports = { fakeSudo };
@@ -77,7 +77,7 @@
      "label": "CI gates + preflight",
      "icon": "🧪",
      "gate": true,
-      "command": "agenthub lanes hook ci-gate",
+      "command": "agenthub workspace hook ci-gate",
      "aliases": ["pre-push-gate", "tests", "migration-collision", "sync-conflict"],
      "detect": [
        {
@@ -95,7 +95,7 @@
      "label": "E2e on feature branch",
      "icon": "🧪",
      "gate": false,
-      "command": "agenthub lanes up --qc",
+      "command": "agenthub workspace up --qc",
      "aliases": ["e2e", "e2e-scoped", "booting", "live"],
      "detect": [
        {
@@ -143,7 +143,7 @@
      "label": "Browser QC",
      "icon": "🔍",
      "gate": true,
-      "command": "agenthub lanes proof-link",
+      "command": "agenthub workspace proof-link",
      "aliases": [],
      "detect": [
        {
@@ -152,7 +152,7 @@
        },
        {
          "tool": "Bash",
-          "match": "\\bagenthub\\b[^;&|]*\\blanes proof-link\\b"
+          "match": "\\bagenthub\\b[^;&|]*\\b(?:lanes|workspace) proof-link\\b"
        }
      ]
    },
@@ -219,7 +219,7 @@
      "label": "Watching PR",
      "icon": "👁",
      "gate": false,
-      "command": "agenthub lanes ci status",
+      "command": "agenthub workspace ci status",
      "aliases": ["pr-comment-fix"],
      "detect": [
        {
@@ -2,10 +2,10 @@
 * @file Tests POST /api/hooks/event for a hook Grok Build fired through the
 * Claude hooks in `~/.claude/settings.json` (Grok's Claude compatibility): it
 * arrives with no `tool`, is told apart by the camelCase keys only Grok sends
- * (`hookEventName`, `workspaceRoot`), and lands as a `tool = 'grok'` session
- * on the grok workspace — never the claude one sharing the directory — with
- * its `transcript_path` dropped. A Claude hook is left Claude's. The DB lives
- * in a temp dir.
+ * (`hookEventName`, `workspaceRoot`), and dropped — Grok is not an AgentHub
+ * tool, and taken as Claude's it would bind the claude workspace and name a
+ * Grok file as a Claude transcript. A Claude hook is left Claude's. The DB
+ * lives in a temp dir.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -58,23 +58,18 @@ const grokData = (id, extra = {}) => ({
 });

 describe("Grok hooks through the Claude settings", () => {
-  it("records a grok session, on the grok workspace, with no transcript path", async () => {
+  it("drops a Grok hook: no session, no event, no workspace bound", async () => {
    const claudeLane = lanes.createLane({ title: "c", cwd: CWD, tool: "claude" });
-    const grokLane = lanes.createLane({ title: "g", cwd: CWD, tool: "grok" });
    const id = "0199f0aa-1111-7222-8333-444455556666";
-    await post({ hook_type: "SessionStart", data: grokData(id) });
+    const r = await post({ hook_type: "SessionStart", data: grokData(id) });
+    assert.equal(r.ignored, true);
    await post({
      hook_type: "UserPromptSubmit",
      data: grokData(id, { hookEventName: "user_prompt_submit", prompt: "fix the bug" }),
    });
-    const s = db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
-    assert.equal(s.tool, "grok");
-    assert.equal(s.transcript_path, null);
-    const events = db.prepare("SELECT data FROM events WHERE session_id = ?").all(id);
-    assert.ok(events.length >= 1);
-    for (const e of events) assert.equal(JSON.parse(e.data).transcript_path, undefined);
+    assert.equal(db.prepare("SELECT * FROM sessions WHERE id = ?").get(id), undefined);
+    assert.equal(db.prepare("SELECT COUNT(*) n FROM events WHERE session_id = ?").get(id).n, 0);
    assert.equal(lanes.getLane(claudeLane.id).session_id, null);
-    assert.equal(lanes.getLane(grokLane.id).session_id, id);
  });

  it("leaves a Claude hook Claude's", async () => {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
nntrivi2001	631ea96f19	chore: v2.8.26 — React 19 / Express 5 / xterm 6, bigger file drops, hidden-tab terminal size fix	2026-10-26 16:36:49 +07:00
nntrivi2001	dce32b96b7	fix(drop): stream every dropped file to disk; no local size cap - POST /api/run/drop-file pipes the body to its file as it arrives in every case — a member's (S3) through `write-as … replace` with the bytes on stdin — instead of buffering up to 20 MB in memory for a remote browser. - Remote limit (server mode, a LAN browser) 20 MB → 500 MB, as a Files upload. - A loopback browser in local mode has no cap any more, only the data dir's free space less a 1 GB reserve; ETOOBIG's max_bytes is what still fits, so the UI's "at most N MB" stays true. - drop-image keeps its 20 MB in-memory limit, now checked on its own. - fake-sudo gains a spawn for run-as.__setSpawnImpl.	2026-10-26 16:36:29 +07:00
nntrivi2001	a0cd808456	fix(terminal): a pane on a hidden tab never shrinks its tmux window A terminal mounted on a hidden tab sits in a 0x0 box; its first fit shrank xterm to 12x6 and the attach carried that size to tmux, so every background pane was squeezed (Claude's TUI redrawn at 12 columns). It now neither fits nor reports a size until shown, attaches with no size, and the server spawns such an attach at the window's own size (tmux.windowSize). A shown tab reports its size even when the fit did not change xterm's. Settings > Agents shows the host's login profiles to staff only: a developer got two 403s from reads that were never theirs.	2026-10-26 14:53:29 +07:00
nntrivi2001	e3745d7504	fix(build): target ES2021 so esbuild keeps xterm 6's requestMode variable Vite's es2020 default made esbuild 0.25 lower `let r; …(r\|\|={})` to `void 0\|\|(i={})` without the declaration, so every DECRQM query tmux sends threw "i is not defined" inside the terminal's parser. Found by a headless smoke run of the preview build.	2026-10-26 14:43:01 +07:00
nntrivi2001	8546748759	chore: maintenance — dependency majors, rename step 4, member Claude config, OpenAPI coverage Dependencies - Security: body-parser and multer DoS advisories fixed (npm audit: 0). - Server: Express 5 (query parser kept "extended", req.body defaults to {}, SPA catch-all /{splat}, send-file helper restores Express 4's dot-folder rule for sendFile/download, alerts ack route without inline regex), better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5. - Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one, DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1, TypeScript 7, i18next/react-i18next/codemirror minors. Workspace rename step 4 - `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts, the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted. Server mode (S3): members manage their own Claude Code config - server/lib/cc-target.js resolves whose config a /cc-config request touches and gates the router by allowlist; /profiles and /plugins/update-all stay admin-only. Member writes go through write-as, CLI calls through sudo as the member (never -y), reads through openSafe; cc_config_changed reaches only its owner. Not verified live on an S3 install yet. Other - Chat: an HTML file is an artifact only when written whole and not a project page (index.html, or under src/, public/, templates/, …). - OpenAPI covers every /api route; openapi-coverage.test.js guards it. - read-pool test keeps its event loop alive (its worker is unref'd). - Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.	2026-10-26 14:22:41 +07:00
nntrivi2001	cc2ece94c3	fix(ui): drop the git clone hints from Git identity and the background toast on closing the update dialog	2026-10-26 14:22:18 +07:00
nntrivi2001	6b602c76b8	chore: v2.8.25 — per-user Today, Alt+V image paste on Windows, local paste/drop by path	2026-10-26 11:18:05 +07:00
nntrivi2001	f2f1cd9b6c	fix: per-user Today, native paste and drop on a local machine - Today's spend in the status bar and the Claude Code statusline is the caller's own (`GET /api/pricing/cost?mine=1`, scope.ownSessionWhere), not every user's sum for an admin or analyst. - A screenshot pasted into a local claude pane is sent as Claude Code's own image-paste key: Alt+V on Windows (Ctrl+V did nothing there), ^V elsewhere, and only when the machine can read its clipboard (wl-paste/xclip + a display on Linux), else it is uploaded (GET /api/run/native-paste {key}). - A file manager's files pasted or dropped on a local browser go in by their own paths, read from the OS clipboard or the file manager's selection (server/lib/file-manager.js, POST /api/run/clipboard-files and /selected-files): no upload, no size limit. A copied image file is pasted by path, text that comes with a picture of it (spreadsheet cells) is pasted as text, Windows paths go in as `C:/…` mentions. - Tab titles for Snapshot, Artifacts, Files and Administration. - An npm tool AgentHub installed under ~/.local is updated there, not by its own updater into npm's global prefix.	2026-10-26 11:18:05 +07:00
nntrivi2001	c59e196e41	chore: v2.8.24 — sub-agent edits in Edited N files, OpenCode/Grok dropped, Artifacts list view and skill sync Edited N files (#86): a turn's card counts the files its subagents wrote or edited (read from their own transcripts, nested ones folded in), and a turn longer than the chat's first page keeps the edits made before the page cut. A non-Claude transcript page honours its limit again. AI tools: OpenCode and Grok Build left the catalog (opencode-usage.js gone; a Grok payload on the Claude hook route is dropped), and so did the leftover Kimi Code quota reader. Artifacts: a list view, skill packs and badges only by exception; a shared skill follows its owner's folder, and an installer whose copy differs is offered Update.	2026-10-26 09:46:45 +07:00
nntrivi2001	72aef2426c	feat(artifacts): a shared skill follows its owner's folder; installers get Update A skill in the Hub was a snapshot taken once: the owner changing ~/.claude/skills/<name> changed nothing there, and an installer had to uninstall and install again to get a newer version. - syncSkillSources (on GET /api/artifacts, at most every 15 s): a skill row taken from a folder — the owner's ~/.claude/skills/<name>, or the workspace's .claude/skills/<name> — is brought up to it. Only a folder whose names/sizes/mtimes changed is read again, with a pick's checks (no symlink, no secret, <= 5 MB, a member's files as theirs); a change is a NEW snapshot, the old one dropped, and an artifact_changed broadcast. - artifacts.version (snapshot content hash) and source_hash (the folder's when last taken, additive columns): an upload or a Hub edit records the folder as it is then, so only a LATER folder change replaces it. - A list row's updateAvailable: installed, and the viewer's copy differs from version. The page shows Update (a pack: Update N); install with {update: true} replaces the copies (old ones moved aside) and is not counted as another install.	2026-10-26 09:34:21 +07:00
nntrivi2001	244f999538	feat(artifacts): list view, skill packs, badges by exception The page showed every artifact as a tall card with a blue Install and four text actions, a Shared badge on nearly all of them and 12 cards per section, so 26 artifacts filled ~1900px (5000px on a phone). - List view by default (Grid kept, a per-browser choice): one row per artifact — kind icon, name, one line of description, owner and installs, ONE primary action, everything else in its ⋯ menu / right-click. - Three or more skills of one owner sharing a name prefix (sg-, vp-) are one pack row: open it for its skills, or Install all / Install N more after one confirmation (a name already there is left alone). - Badges only for the exception: Private (not shared), Hub only, Auto. - No per-section paging: 30 entries, then Show more. - Scope tabs under the title; category chips scroll on a phone. - Another user's private row (seen by an admin) gets its own section instead of sitting under Shared by others. - "1 installs" → "1 install".	2026-10-26 09:34:10 +07:00
nntrivi2001	127da516ac	chore(quota): drop the Kimi Code quota reader (Kimi already left the catalog) Redone on v2.8.22 from 3179d25 (feat/grok-usage, never merged).	2026-10-26 09:31:37 +07:00
nntrivi2001	c0832182f2	feat(ai-tools): drop OpenCode and Grok Build - opencode.json / grok.json leave the built-in catalog; opencode-usage.js, its poller, transcript branch and table creation go with it (existing tables and session rows stay as history). - A Grok payload reaching the Claude hook route (Grok runs the Claude hooks itself) is dropped instead of recorded as tool = 'grok'. - quota.js no longer reads Grok or OpenCode Go logins. - Redone on v2.8.22 from c6b2892 (feat/grok-usage, never merged).	2026-10-26 09:31:30 +07:00
nntrivi2001	9ea7758abb	fix(transcript): a non-Claude page honours its limit again (#86 ) `carry?.drop(messages.shift())` skips its argument when `carry` is null — optional chaining short-circuits the whole call — so a Codex, omp, Cursor or Antigravity page never shifted its sliding window and returned the whole journal (codex-transcript.test.js: 8 messages for ?limit=2). Shift first, then hand the dropped message to the carry.	2026-10-26 08:35:39 +07:00
nntrivi2001	f51a6a895e	fix(chat): keep a long turn's Edited N files card whole across the page cut (#86 ) The reported turn (/vp-auto, ~120 messages) showed "Edited 1 file": the chat loads the newest 50 messages, and the turn's other Write (rbac_routes_test.go, +176) was in the part before the page. - turnCarry (agent-edits.js): every message the route's sliding window drops goes through it; it keeps the file changes since the last prompt it dropped (a dropped call whose result is on the page, and dropped subagents, included). - A Claude page that starts mid-turn answers them as `turn_edits`; the chat keeps the one from the page that holds its oldest message and adds it to that turn's card. Files a turn changed through Bash (python/sed writing a file) are still not listed: nothing in the transcript says which files a command wrote.	2026-10-26 08:32:45 +07:00
nntrivi2001	5ccbaf5c23	fix(chat): count a subagent's edits in the turn's Edited N files card (#86 ) A skill that hands its work to subagents (vp-auto) showed "Edited 1 file" for a turn that changed 4: a subagent's Write/Edit calls are in its own agent-<id>.jsonl, so the card only saw the parent's. - server/lib/agent-edits.js reads a subagent's transcript (readLines, a member's only as theirs) for the files it wrote or edited with their +/- lines, nested subagents folded in (3 levels), cached by size + mtime. - The transcript route puts them on each Claude Agent/Task result as `edits`; the card adds them to the turn's own edits. A file only a subagent wrote is listed, never an artifact card (its versions are rebuilt from this transcript's inputs, which a subagent's are not).	2026-10-26 08:32:45 +07:00