chore: v2.8.45 — Share again updates a shared skill; a same-named upload updates it too

feat(artifacts): Share again takes a skill's newest version; a same-named upload updates it
A shared skill followed its owner's ~/.claude/skills folder only, so one uploaded from a browser (or living in a plugin) stayed at its first snapshot for good. Share again (a skill's ⋯ menu and detail sheet) now takes the owner's copy on the server — its source folder, else the same-named skill of a plugin they installed at user scope — and shares it; with no copy it asks for the folder and uploads it onto that row (`id`). An upload whose skill is named like one the uploader already has replaces that row's version instead of adding a twin. Installers are then offered Update, as before.
2026-10-30 14:20:51 +07:00 · 2026-10-30 14:20:18 +07:00 · 2026-10-30 13:05:48 +07:00 · 2026-10-30 13:05:13 +07:00 · 2026-10-30 10:34:51 +07:00 · 2026-10-30 10:33:57 +07:00
61 changed files with 4742 additions and 163 deletions
@@ -1,4 +1,8 @@
 {
+  "env": {
+    "ANTHROPIC_BASE_URL": "",
+    "ANTHROPIC_AUTH_TOKEN": ""
+  },
  "permissions": {
    "allow": [
      "Bash(npm run:*)",
@@ -36,11 +40,8 @@
      "Bash(node -e ':*)",
      "Bash(node -e \"require\\('./server/lib/transcript-cache'\\); require\\('./scripts/import-history'\\); console.log\\('All modules load OK'\\)\")",
      "Bash(claude --version)",
-      "Bash(gh pr *)"
+      "Bash(gh pr *)",
+      "Bash(grep *)"
    ]
-  },
-  "env": {
-    "ANTHROPIC_BASE_URL": "",
-    "ANTHROPIC_AUTH_TOKEN": ""
  }
 }
@@ -15,8 +15,10 @@ import { FileText, Loader2 } from "lucide-react";
 import { artifactDocument, frameSandbox } from "../lib/artifactView";
 import { blobText, inlineHtml, type FetchFile } from "../lib/htmlInline";

-/** A page read by `fetchFile` is shown up to this size. */
-const HTML_MAX = 10 * 1024 * 1024;
+/** A page read by `fetchFile` is shown up to this size. A self-contained
+ *  page (a slide deck with its video and images inlined as base64) is easily
+ *  past 10 MB; the iframe renders far larger documents than this. */
+const HTML_MAX = 64 * 1024 * 1024;

 export function HtmlFrame({
  path,
@@ -3,7 +3,8 @@
 * @description Tests for the sidebar's workspace list: one flat row per
 * workspace in the stored order, a row expanding to its sessions (remembered),
 * a live session opening its pane and an ended one its transcript, the
- * workspace's OWN sessions only, a session's state dot, rename and archive,
+ * workspace's OWN sessions only, a session's state dot, rename and archive
+ * (a live one's pane stopped first),
 * selection
 * by URL, Alt+arrow reordering kept in localStorage, double-click rename, the
 * search, the row menu's items by kind and tool, the status dot, and the
@@ -225,6 +226,8 @@ describe("WorkspaceTree", () => {
    await user.type(input, "Better name{Enter}");
    expect(api.sessions.patch).toHaveBeenCalledWith("s-old", { name: "Better name" });
    await user.click(screen.getByTestId("workspace-session-archive-s-live"));
+    // A live session's Archive stops its pane first — never a hidden pane left running.
+    expect(api.run.kill).toHaveBeenCalledWith("agenthub-lane-1-2", { archive: true });
    expect(api.sessions.patch).toHaveBeenCalledWith("s-live", { archived: true });
  });

@@ -1470,25 +1470,40 @@ export function LaneChangesPanel({
    }
  };

-  // Discard all: every non-conflicted file in one `discard`, asked once in a
-  // dialog that names how many untracked files it will delete.
-  const discardAll = async () => {
-    const rows = files.filter((f) => !f.conflicted);
-    if (!rows.length) return;
+  // Discard selected: exactly what Commit would take — the ticked files, and
+  // only the ticked blocks of a partly ticked one (#87: it used to discard
+  // every file, ticked or not) — in one `discard`, asked once in a dialog
+  // that names how many untracked files it will delete.
+  const discardTicked = async () => {
+    if (!tickedPaths.length) return;
    const ok = await confirmDialog({
-      title: t("changes.discardAllTitle"),
-      message: t("changes.discardAllConfirm", {
-        count: rows.length,
-        untracked: rows.filter((f) => f.untracked).length,
+      title: t("changes.discardTickedTitle"),
+      message: t("changes.discardTickedConfirm", {
+        count: tickedPaths.length,
+        untracked: files.filter((f) => f.untracked && tickedPaths.includes(f.path)).length,
      }),
-      confirmLabel: t("changes.discardAll"),
+      confirmLabel: t("changes.discardTicked"),
    });
-    if (ok)
-      await act(
-        "discard",
-        rows.map((f) => f.path),
-        true
-      );
+    if (!ok) return;
+    const lane = laneId;
+    setBusy(true);
+    setError(null);
+    try {
+      const { paths, hunks } = await selection();
+      await api.lanes.gitAction(target, "discard", {
+        paths,
+        ...(hunks ? { hunks, context: CONTEXT_STEPS[0] } : {}),
+        confirm: true,
+      });
+      if (laneNow.current !== lane) return;
+      setConfirmDiscard(null);
+      refreshGit();
+      await load();
+    } catch (err) {
+      if (laneNow.current === lane) setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      if (laneNow.current === lane) setBusy(false);
+    }
  };

  // resolve / merge-commit / merge-abort: same shape as `act`, other body.
@@ -2067,8 +2082,7 @@ export function LaneChangesPanel({
  // An HTML page's relative CSS/scripts/images, read like a download — only
  // from the working tree: a commit's page would get today's files.
  const htmlFetch = useMemo(
-    () =>
-      range === "commit" ? null : fetchVia((p) => api.lanes.gitDownloadUrl(target, p)),
+    () => (range === "commit" ? null : fetchVia((p) => api.lanes.gitDownloadUrl(target, p))),
    // eslint-disable-next-line react-hooks/exhaustive-deps
    [range, JSON.stringify(target)]
  );
@@ -2863,13 +2877,13 @@ export function LaneChangesPanel({
                    <button
                      type="button"
                      data-testid="lane-changes-discard-all"
-                      disabled={busy}
-                      onClick={() => void discardAll()}
-                      title={t("changes.discardAllTitle")}
+                      disabled={busy || tickedPaths.length === 0}
+                      onClick={() => void discardTicked()}
+                      title={t("changes.discardTickedTitle")}
                      className="shrink-0 flex items-center gap-1 rounded border border-border-light px-1.5 py-0.5 text-[11px] text-status-danger hover:bg-status-danger/10 disabled:cursor-not-allowed disabled:opacity-40"
                    >
                      <Trash2 className="h-3 w-3" aria-hidden />
-                      {t("changes.discardAll")}
+                      {t("changes.discardTicked", { count: tickedPaths.length })}
                    </button>
                  </div>
                </div>
@@ -179,6 +179,18 @@ export function langFor(filePath: string) {
 }

 /** Tokenized line text. `emph` marks the span that actually changed. */
+/** The tail of a row the server cut down (`LaneDiffLine.elided`). */
+function Elided({ n }: { n?: number }) {
+  const { t, i18n } = useTranslation("lanes");
+  if (!n) return null;
+  const size = new Intl.NumberFormat(i18n.language, { notation: "compact" }).format(n);
+  return (
+    <span className="ml-1 select-none rounded bg-surface-3 px-1 font-sans text-[10px] text-fg-muted">
+      {t("changes.lineElided", { size })}
+    </span>
+  );
+}
+
 function Code({ text, lang, emph }: { text: string; lang: string; emph?: [number, number] }) {
  if (emph) {
    const [from, to] = emph;
@@ -544,6 +556,7 @@ function UnifiedLine({
          {line.type === "add" ? "+" : line.type === "del" ? "-" : " "}
        </span>
        <Code text={line.text} lang={lang} emph={emph} />
+        <Elided n={line.elided} />
      </span>
      {bar && <HunkBar change={bar} />}
    </Row>
@@ -621,6 +634,7 @@ function SplitLine({
      />
      <span className="whitespace-pre px-1">
        {line ? <Code text={line.text} lang={lang} emph={e} /> : null}
+        {line ? <Elided n={line.elided} /> : null}
      </span>
      {bar && <HunkBar change={bar} />}
    </Row>
@@ -14,7 +14,7 @@
 * a catalog tool's bypass — a YOLO chip for Codex) and Local / New worktree — the workspace's Recents — the sessions it
 * owns and has not archived (`?lane=&archived=0`, with each one's state dot,
 * **Show more** past the first page, and the sidebar row's Rename/Archive in
- * its right-click menu), then the archived ones folded with Unarchive; a live session opens its pane,
+ * its right-click menu — Archive on a live session stops its pane first, `endRuns`), then the archived ones folded with Unarchive; a live session opens its pane,
 * any other its conversation (`&session=`, `SessionReplay`), nothing is resumed — and on the right its context: Instructions, Memory (read-only), Context files and
 * Folders (`WorkspaceContext.tsx`, also folded at the bottom of the Changes panel).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -22,6 +22,7 @@

 import { isSubmitEnter } from "../../lib/keys";
 import { confirmDialog } from "../../lib/confirm";
+import { endRuns } from "../../lib/stopSession";
 import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
@@ -307,30 +308,30 @@ function HomeBody({
    }
  };
  const archiveSession = async (s: Session) => {
-    const live = !!liveRunFor(lane, liveRuns, s.id);
+    const run = liveRunFor(lane, liveRuns, s.id);
+    // A live one is stopped first, as the tab's X does (its own confirm):
+    // archiving only its row left a pane running that no list showed.
+    if (run) {
+      if ((await endRuns([run], { name: s.name || t("tree.newSession"), t })).length)
+        await patchSession(s, { archived: true });
+      return;
+    }
    const wt = sessionWorktreeName(lane, s);
    const ok = await confirmDialog(
-      wt && !live
+      wt
        ? {
            title: t("tree.archiveWorktreeTitle"),
            message: t("tree.archiveWorktreeBody", { name: wt }),
            confirmLabel: t("tree.archiveWorktreeConfirm"),
          }
-        : live
-          ? {
-              title: t("tree.archiveLiveTitle"),
-              message: t("tree.archiveLiveBody"),
-              confirmLabel: t("sessionMenu.archive"),
-              destructive: false,
-            }
-          : {
-              title: t("tree.archiveSession"),
-              confirmLabel: t("sessionMenu.archive"),
-              destructive: false,
-            }
+        : {
+            title: t("tree.archiveSession"),
+            confirmLabel: t("sessionMenu.archive"),
+            destructive: false,
+          }
    );
    if (!ok) return;
-    if (wt && !live) {
+    if (wt) {
      try {
        await api.lanes.removeSessionWorktree(lane.id, s.id).catch((err: unknown) => {
          if ((err as { code?: string }).code !== "ENOWORKTREE") throw err;
@@ -24,7 +24,7 @@
 * The list shows `SESSION_LIMIT` rows and a **See all (N more)** under them that
 * loads every one, then a **Show less** that goes back to `SESSION_LIMIT`. A
 * live tab whose session was archived is not brought back as a New session,
- * and archiving a live one asks first. F2 renames the focused row too; each
+ * and archiving a live one STOPS it first (`endRuns`, the tab X's confirm). F2 renames the focused row too; each
 * dot carries its meaning as screen-reader text. `readOnly` (another user's
 * workspace, for an analyst): no live tabs, no rename/archive/menu, and a row
 * opens the session's analysis page (`/sessions/<id>`) — never a pane or a resume.
@@ -32,7 +32,7 @@
 */

 import { useEffect, useState, type ReactNode } from "react";
-import { confirmDialog } from "../../lib/confirm";
+import { endRuns } from "../../lib/stopSession";
 import { isSubmitEnter } from "../../lib/keys";
 import { Archive, GitBranch, Pin, PinOff, SquareTerminal } from "lucide-react";
 import { useTranslation } from "react-i18next";
@@ -363,17 +363,10 @@ export function WorkspaceSessionList({
  };
  const archive = async (s: Session) => {
    if (sessionWorktreeName(lane, s) && !runFor(s)) return setArchiving(s);
-    // A live one keeps running in its tab; archiving only hides its row.
-    if (
-      runFor(s) &&
-      !(await confirmDialog({
-        title: t("tree.archiveLiveTitle"),
-        message: t("tree.archiveLiveBody"),
-        confirmLabel: t("sessionMenu.archive"),
-        destructive: false,
-      }))
-    )
-      return;
+    // A live one is stopped first, as the tab's X does: archiving only its row
+    // left a pane running that no list showed any more.
+    const run = runFor(s);
+    if (run && !(await endRuns([run], { name: s.name || t("tree.newSession"), t })).length) return;
    await patch(s, { archived: true });
  };
  const archiveWithWorktree = async (s: Session) => {
@@ -837,10 +837,12 @@ describe("LaneChangesPanel", () => {
    });
  });

-  it("discards every file at once only after the dialog is confirmed", async () => {
+  it("discards only the ticked files, and only after the dialog is confirmed (#87)", async () => {
    const user = userEvent.setup();
    render(<LaneChangesPanel laneId={7} />);
    await screen.findByTestId("lane-changes-overview");
+    // notes.txt (unversioned) starts unticked; untick docs/API.md too.
+    await user.click(tickOf("docs/API.md"));

    vi.mocked(confirmDialog).mockResolvedValueOnce(false);
    await user.click(screen.getByTestId("lane-changes-discard-all"));
@@ -849,10 +851,14 @@ describe("LaneChangesPanel", () => {
    await user.click(screen.getByTestId("lane-changes-discard-all"));
    await waitFor(() =>
      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "discard", {
-        paths: ["server/lib/git-ops.js", "notes.txt", "docs/API.md"],
+        paths: ["server/lib/git-ops.js"],
        confirm: true,
      })
    );
+
+    // Nothing ticked: nothing to discard.
+    await user.click(tickOf("server/lib/git-ops.js"));
+    expect(screen.getByTestId("lane-changes-discard-all")).toBeDisabled();
  });

  it("right-click on a changed file offers Commit File, a two-click discard, copy path and patch", async () => {
@@ -1673,6 +1679,25 @@ describe("LaneChangesPanel", () => {
      expect(api.lanes.gitAction).not.toHaveBeenCalled();
    });

+    it("discards only the ticked change blocks of a partly ticked file (#87)", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      await user.click(
+        screen.getAllByRole("checkbox", { name: "Include this change in the commit" })[1]!
+      );
+      await user.click(screen.getByRole("button", { name: "Changes" }));
+      await screen.findByTestId("lane-changes-commit");
+      await user.click(screen.getByTestId("lane-changes-discard-all"));
+      await waitFor(() =>
+        expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "discard", {
+          paths: [],
+          hunks: { "server/lib/git-ops.js": [{ hunk: "@@ -1,2 +1,3 @@", blocks: [0] }] },
+          context: 3,
+          confirm: true,
+        })
+      );
+    });
+
    it("commits only the ticked change blocks of a partly ticked file (hunks)", async () => {
      const user = userEvent.setup();
      await openReview(user);
@@ -609,3 +609,26 @@ describe("LaneDiffView — line comments", () => {
    expect(screen.queryByTestId("diff-comment-line-1")).toBeNull();
  });
 });
+
+describe("LaneDiffView — a row the server cut down", () => {
+  const CUT: LaneChangeFile = {
+    ...FILE,
+    hunks: [
+      {
+        ...FILE.hunks![0]!,
+        lines: [
+          { type: "del", oldLine: 1, newLine: null, text: '<video src="AAAA', elided: 3_000_000 },
+          { type: "add", oldLine: null, newLine: 1, text: '<video src="BBBB', elided: 3_000_000 },
+        ],
+      },
+    ],
+  };
+
+  it("says how much of the row it hides, in both layouts", () => {
+    const { unmount } = render(<LaneDiffView file={CUT} layout="unified" />);
+    expect(screen.getAllByText(/3M more characters on this line/)).toHaveLength(2);
+    unmount();
+    render(<LaneDiffView file={CUT} layout="split" />);
+    expect(screen.getAllByText(/3M more characters on this line/)).toHaveLength(2);
+  });
+});
@@ -96,6 +96,36 @@ type DropState = "hint" | "paste" | "uploading" | "failed" | "tooBig" | "tooBigL
 /** localStorage flag for xterm's screen-reader mode (a Settings toggle can set it later). */
 export const SCREEN_READER_KEY = "agenthub.terminal.screenReader";
 /** localStorage flag: the "Shift+drag selects text" hint was dismissed. */
+/** The atlas a WebGL addon draws from: @xterm/addon-webgl 0.19 keeps these
+ *  fields unminified in its build. Undefined on any other shape. */
+type AtlasPages = { pages: { version: number }[] };
+const atlasOf = (addon: WebglAddon): AtlasPages | undefined => {
+  const atlas = (addon as unknown as { _renderer?: { _charAtlas?: AtlasPages } })._renderer
+    ?._charAtlas;
+  return Array.isArray(atlas?.pages) ? atlas : undefined;
+};
+/** Last version handed out by `restampAtlas`, shared by every pane. */
+let atlasStamp = 0;
+/**
+ * Gives every page of the addon's glyph atlas a version no texture slot has
+ * uploaded, so EVERY renderer sharing that atlas re-uploads every page from
+ * its canvas on its next draw — what addon-webgl 0.20 does with globally
+ * monotonic page versions. 0.19 counts per page, so after a merge shifts the
+ * pages down a slot can hold a stale page whose counter happens to match, and
+ * glyphs are sampled squeezed or foreign. Steps of 2^24 stay clear of the
+ * per-glyph increments a page makes before the next restamp. False when the
+ * addon is not the shape this knows.
+ */
+const restampAtlas = (addon: WebglAddon): boolean => {
+  const atlas = atlasOf(addon);
+  if (!atlas) return false;
+  for (const page of atlas.pages) {
+    atlasStamp += 2 ** 24;
+    page.version = atlasStamp;
+  }
+  return true;
+};
+
 const SELECT_HINT_KEY = "agenthub.terminal.selectHintSeen";
 const readFlag = (key: string) => {
  try {
@@ -468,7 +498,8 @@ export const TerminalView = memo(function TerminalView({
      // A terminal mounted on a hidden tab sits in a 0×0 box (`display:none`):
      // fitting it there shrinks xterm to its 12×6 minimum, and that size would
      // reach tmux with the attach. It stays unfitted until it is shown.
-      const hasBox = () => !!containerRef.current?.clientWidth && !!containerRef.current.clientHeight;
+      const hasBox = () =>
+        !!containerRef.current?.clientWidth && !!containerRef.current.clientHeight;
      if (hasBox()) fit.fit();
      // Take the keyboard as soon as the pane is on screen: the terminal IS the
      // page here, and having to click it first meant the first thing typed went
@@ -761,6 +792,44 @@ export const TerminalView = memo(function TerminalView({
        refit();
      };
      document.fonts?.addEventListener("loadingdone", onFontLoaded);
+      // @xterm/addon-webgl 0.19 shares ONE glyph atlas between every terminal
+      // with the same font. When it fills up it merges four pages into one
+      // larger page and shifts the rest down, and a GPU texture is re-uploaded
+      // only when its page's `version` differs from the uploaded one — after a
+      // shift those per-page counters can coincide, so a slot keeps a stale
+      // page of another size and every glyph is drawn squeezed or foreign
+      // while the buffer stays correct (fixed upstream only in 0.20 betas).
+      // Any change to the page list therefore restamps every page's version
+      // (`restampAtlas`) synchronously, before the next draw of ANY pane on
+      // that atlas. `clearTextureAtlas` is no fix: it empties the SHARED atlas
+      // but redraws only this pane, leaving its siblings slicing reused space.
+      // An addon of another shape falls back to toggling the family's
+      // trailing space on the next frame, which makes each renderer re-acquire
+      // its atlas (as onFontLoaded does).
+      let atlasFrame = 0;
+      const rebuildAtlas = () => {
+        if (gpu && restampAtlas(gpu)) return true;
+        if (atlasFrame) return false;
+        // Never inside the render that is rasterizing the merging glyph.
+        atlasFrame = requestAnimationFrame(() => {
+          atlasFrame = 0;
+          const family = term.options.fontFamily ?? "";
+          term.options.fontFamily = family.endsWith(" ") ? family.trimEnd() : `${family} `;
+        });
+        return false;
+      };
+      const atlasMerged = gpu?.onRemoveTextureAtlasCanvas(rebuildAtlas);
+      const atlasGrew = gpu?.onAddTextureAtlasCanvas(rebuildAtlas);
+      // The browser may also drop the textures without a context-loss event
+      // (sleep/resume, a long-backgrounded tab): re-upload when the page is
+      // back, and repaint, since nothing else asks this pane to draw.
+      const onPageShown = () => {
+        if (document.visibilityState === "visible" && rebuildAtlas()) {
+          term.refresh(0, term.rows - 1);
+        }
+      };
+      document.addEventListener("visibilitychange", onPageShown);
+      window.addEventListener("focus", onPageShown);
      // Settings → Appearance changed the terminal's font or size: an open
      // pane takes it now, re-measured and re-fitted like a font landing.
      const onFontPref = () => {
@@ -779,6 +848,11 @@ export const TerminalView = memo(function TerminalView({
        searchRef.current = null;
        resizeObserver.disconnect();
        document.fonts?.removeEventListener("loadingdone", onFontLoaded);
+        if (atlasFrame) cancelAnimationFrame(atlasFrame);
+        atlasMerged?.dispose();
+        atlasGrew?.dispose();
+        document.removeEventListener("visibilitychange", onPageShown);
+        window.removeEventListener("focus", onPageShown);
        window.removeEventListener(FONT_SIZE_EVENT, onFontPref);
        term.textarea?.removeEventListener("focus", reassert);
        detachIme();
@@ -63,6 +63,9 @@ const termState = {
 };
 const onResizeHandlers: Array<() => void> = [];
 const termOptions: { theme?: unknown } = {};
+const refreshMock = vi.fn();
+/** The atlas the next WebGL addon draws from; null = an addon of another shape. */
+const nextAtlas: { pages: { version: number }[] | null } = { pages: null };
 const ctorArgs: Array<{ theme?: unknown }> = [];

 vi.mock("@xterm/xterm", () => ({
@@ -92,6 +95,7 @@ vi.mock("@xterm/xterm", () => ({
      return { dispose: vi.fn() };
    },
    dispose: disposeMock,
+    refresh: refreshMock,
    loadAddon: loadAddonMock,
    attachCustomWheelEventHandler: wheelHandlerMock,
    attachCustomKeyEventHandler: keyHandlerMock,
@@ -112,21 +116,44 @@ vi.mock("@xterm/addon-fit", () => ({
  FitAddon: vi.fn().mockImplementation(() => ({ fit: vi.fn() })),
 }));
 // The newest WebGL addon, with the context-loss listener the view gave it.
-const gpu: { last: { dispose: ReturnType<typeof vi.fn>; lose: () => void } | null } = {
+const gpu: {
+  last: {
+    dispose: ReturnType<typeof vi.fn>;
+    lose: () => void;
+    merge: () => void;
+    grow: () => void;
+  } | null;
+} = {
  last: null,
 };
 vi.mock("@xterm/addon-webgl", () => ({
  WebglAddon: vi.fn().mockImplementation(() => {
    let onLoss = () => {};
+    let onMerge = () => {};
+    let onGrow = () => {};
    const addon = {
      __webgl: true,
+      ...(nextAtlas.pages ? { _renderer: { _charAtlas: { pages: nextAtlas.pages } } } : {}),
      dispose: vi.fn(),
      onContextLoss: (fn: () => void) => {
        onLoss = fn;
        return { dispose: vi.fn() };
      },
+      onRemoveTextureAtlasCanvas: (fn: () => void) => {
+        onMerge = fn;
+        return { dispose: vi.fn() };
+      },
+      onAddTextureAtlasCanvas: (fn: () => void) => {
+        onGrow = fn;
+        return { dispose: vi.fn() };
+      },
+    };
+    gpu.last = {
+      dispose: addon.dispose,
+      lose: () => onLoss(),
+      merge: () => onMerge(),
+      grow: () => onGrow(),
    };
-    gpu.last = { dispose: addon.dispose, lose: () => onLoss() };
    return addon;
  }),
 }));
@@ -488,6 +515,50 @@ describe("TerminalView", () => {
    expect(disposeMock).not.toHaveBeenCalled(); // the terminal itself lives on
  });

+  it("restamps every atlas page at once when the page list changes", () => {
+    // addon-webgl 0.19 counts versions per page, so after a merge shifts the
+    // pages a texture slot can keep a stale page whose counter matches. Every
+    // page gets a version no slot has uploaded — in every pane on the atlas.
+    const pages = [{ version: 3 }, { version: 7 }, { version: 1 }];
+    nextAtlas.pages = pages;
+    const raf = vi.spyOn(window, "requestAnimationFrame");
+    try {
+      render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+      gpu.last!.merge();
+      const first = pages.map((p) => p.version);
+      expect(new Set(first).size).toBe(3);
+      expect(first.every((v) => v > 7)).toBe(true);
+      gpu.last!.grow();
+      expect(pages.every((p, i) => p.version > Math.max(...first) && p.version !== first[i])).toBe(
+        true
+      );
+      expect(raf).not.toHaveBeenCalled(); // synchronous, before any pane draws
+      // The page coming back re-uploads and repaints this pane.
+      refreshMock.mockClear();
+      window.dispatchEvent(new Event("focus"));
+      expect(refreshMock).toHaveBeenCalledWith(0, 27);
+    } finally {
+      nextAtlas.pages = null;
+      raf.mockRestore();
+    }
+  });
+
+  it("re-acquires the glyph atlas on the next frame after a page merge", () => {
+    // An addon whose atlas this cannot reach: any option change makes each
+    // renderer re-acquire its atlas and re-upload every page.
+    const raf = vi.spyOn(window, "requestAnimationFrame").mockImplementation(() => 1);
+    render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
+    const opts = termOptions as { fontFamily?: string };
+    opts.fontFamily = "JetBrains Mono";
+    gpu.last!.merge();
+    gpu.last!.merge(); // coalesced into one frame
+    expect(raf).toHaveBeenCalledTimes(1);
+    expect(opts.fontFamily).toBe("JetBrains Mono"); // never inside the render that merged
+    (raf.mock.calls[0]![0] as FrameRequestCallback)(0);
+    expect(opts.fontFamily).toBe("JetBrains Mono ");
+    raf.mockRestore();
+  });
+
  // xterm 6 dropped its own Alt+arrow → word-move mapping; the pane keeps it.
  it("sends Alt+arrow as the word-move keys xterm 5 sent", () => {
    expect(altArrowSeq("ArrowLeft", false)).toBe("\x1b[1;5D");
@@ -262,11 +262,11 @@ function LabelEdit({
 function useRunner(load: () => Promise<unknown>) {
  const [busy, setBusy] = useState<string | null>(null);
  const run = useCallback(
-    async (key: string, fn: () => Promise<unknown>, success: string) => {
+    async <T,>(key: string, fn: () => Promise<T>, success: string | ((r: T) => string)) => {
      setBusy(key);
      try {
-        await fn();
-        toast.success(success);
+        const r = await fn();
+        toast.success(typeof success === "function" ? success(r) : success);
        await load();
      } catch (err: unknown) {
        toast.error(err);
@@ -399,7 +399,14 @@ function OtherProfiles({
                  void run(
                    `switch:${p.name}`,
                    () => api.toolProfiles.activate(tool, p.name),
-                    t("toolProfiles.switchSuccess", { name: p.label, tool: label })
+                    (r) =>
+                      t(
+                        r.following ? "toolProfiles.switchFollowing" : "toolProfiles.switchSuccess",
+                        {
+                          name: p.label,
+                          tool: label,
+                        }
+                      )
                  )
                }
                className={btnCls}
@@ -800,9 +807,7 @@ function ProfileUsageLine({

 /** Org / seat / plan line shared by the active card and each profile row. */
 function IdentityLine({ identity }: { identity: CcAccountIdentity }) {
-  const parts = [identity.organization, identity.plan || identity.subscriptionType].filter(
-    Boolean
-  );
+  const parts = [identity.organization, identity.plan || identity.subscriptionType].filter(Boolean);
  if (parts.length === 0) return null;
  return <div className="text-[10px] text-fg-muted mt-0.5">{parts.join(" · ")}</div>;
 }
@@ -2,7 +2,8 @@
 * @file UserEditDialog.tsx
 * @description The Users page's ONE account editor (admin only): profile
 * (display name, email), access (role, active/disabled — neither for your own
- * account), a new password (typed or generated, copyable — someone else's
+ * account — and, for an admin, whether they own the host's Linux account, so
+ * its sessions outside every workspace are billed to them), a new password (typed or generated, copyable — someone else's
 * may be anything and makes them choose their own at next sign-in; your own
 * must pass every rule of `lib/passwordRules.ts`), the workspaces the
 * account owns (remove, add from every workspace), its spend quota (the
@@ -87,6 +88,7 @@ export function UserEditDialog({
  const [email, setEmail] = useState(user.email ?? "");
  const [role, setRole] = useState<Role>(user.role);
  const [active, setActive] = useState(!user.disabled);
+  const [hostAccount, setHostAccount] = useState(Boolean(user.hostAccount));
  const [password, setPassword] = useState("");
  const [showPassword, setShowPassword] = useState(false);
  const [owned, setOwned] = useState<OwnedWorkspace[] | null>(null);
@@ -139,6 +141,7 @@ export function UserEditDialog({
  if (norm(email) !== (user.email ?? null)) patch.email = norm(email);
  if (!self && role !== user.role) patch.role = role;
  if (!self && active === user.disabled) patch.disabled = !active;
+  if (role === "admin" && hostAccount !== Boolean(user.hostAccount)) patch.hostAccount = hostAccount;
  if (password) patch.password = password;
  if (added.length) patch.addWorkspaces = added;
  if (removed.size) patch.removeWorkspaces = [...removed];
@@ -364,6 +367,17 @@ export function UserEditDialog({
                )}
              </div>
            </div>
+            {role === "admin" && (
+              <div className="mt-3">
+                <Checkbox
+                  checked={hostAccount}
+                  onChange={setHostAccount}
+                  label={t("edit.hostAccount")}
+                  labelClassName="text-sm text-fg-secondary"
+                />
+                <p className="ml-6 mt-0.5 text-[11px] text-fg-muted">{t("edit.hostAccountHint")}</p>
+              </div>
+            )}
          </Section>

          <Section title={t("edit.password")}>
@@ -28,6 +28,12 @@
  "unshare": "Unshare",
  "shareDone": "Shared to the Hub",
  "unshareDone": "Removed from the Hub",
+  "reshare": "Share again",
+  "reshareDone": "New version shared — people who installed it are offered Update",
+  "reshareSame": "Already the newest version — shared",
+  "reshareAskTitle": "Choose the {{name}} folder again",
+  "reshareAskBody": "This server has no copy of {{name}}. Choose the skill's folder (the one holding SKILL.md): it replaces this version, and people who installed it are offered Update. For a .zip, upload it through Add skill → Upload: a skill with the same name updates your existing one.",
+  "resharePick": "Choose folder",
  "open": "Open",
  "copyLink": "Copy link",
  "preview": "Preview",
@@ -92,6 +92,7 @@
  "changes.expandFile": "Expand {{path}}",
  "changes.fileGone": "That file no longer has changes in this range.",
  "changes.fileTruncated": "Diff cut short — open the file in an editor for the rest.",
+  "changes.lineElided": "… {{size}} more characters on this line",
  "changes.commentLine": "Comment on line {{n}} — pasted into this workspace's pane",
  "changes.commentOn": "Comment on {{at}} — pasted into the pane you used last; nothing is sent until you press Enter there",
  "changes.commentSend": "Paste into pane",
@@ -505,8 +506,6 @@
  "changes.loadMore": "Load more commits",
  "changes.commentPasted": "Pasted into tab {{tab}} — press Enter there to send it",
  "changes.splitter": "Resize the changes panel",
-  "tree.archiveLiveTitle": "Archive a live session?",
-  "tree.archiveLiveBody": "Its tab keeps running; archiving only hides it from this list. Unarchive it from the archived fold.",
  "tree.state.awaiting": "waiting for you",
  "tree.state.error": "error",
  "tree.state.live": "live",
@@ -533,9 +532,9 @@
  "changes.unversionedGroup": "Unversioned Files",
  "changes.commitTicked": "Commit ({{count}})",
  "changes.commitAndPush": "Commit and Push",
-  "changes.discardAll": "Discard all",
-  "changes.discardAllTitle": "Discard all changes?",
-  "changes.discardAllConfirm": "Every change in {{count}} file(s) goes back to the last commit, and {{untracked}} new file(s) git does not track yet are deleted. This cannot be undone.",
+  "changes.discardTicked": "Discard ({{count}})",
+  "changes.discardTickedTitle": "Discard the ticked changes?",
+  "changes.discardTickedConfirm": "The ticked changes in {{count}} file(s) go back to the last commit, and {{untracked}} ticked new file(s) git does not track yet are deleted. Unticked files and blocks are kept. This cannot be undone.",
  "changes.amendAndPush": "Amend and Push",
  "changes.pushFailed": "Committed, but the push failed: {{error}}",
  "changes.tickFile": "Include {{path}} in the commit",
@@ -1396,6 +1396,7 @@
    "noActive": "{{tool}} holds no login on this machine.",
    "noProfiles": "Could not load the profiles.",
    "switchSuccess": "Switched {{tool}} to \"{{name}}\". Start a new session to use it.",
+    "switchFollowing": "Switched {{tool}} to \"{{name}}\" — running sessions follow it.",
    "deleteConfirmBody": "This removes the saved {{tool}} login. To use it again, sign in from a terminal and save it once more.",
    "loginHint": "Add another {{tool}} login by signing in from a terminal first:",
    "subtitle": {
@@ -79,6 +79,7 @@
    "EBADUSER": "Username: letters, digits, '.', '_' or '-' (up to 64).",
    "EBADPASSWORD": "Password cannot be empty.",
    "EBADEMAIL": "That email address does not look valid.",
+    "ENAMETAKEN": "Another account already uses that name. Pick one that is yours.",
    "EBADFIELD": "One of the values is not valid.",
    "ENOLANE": "That workspace no longer exists.",
    "ENOTOWNED": "That workspace is not this user's any more.",
@@ -111,6 +112,8 @@
    "status": "Status",
    "active": "Active",
    "statusHint": "A disabled user cannot sign in; their workspaces and history stay.",
+    "hostAccount": "Owns this server's host account",
+    "hostAccountHint": "Sessions run as the server's own Linux account outside every workspace (a script's claude -p, a CLI in a plain terminal) count toward this admin's spend. At most one admin; with none marked, the only admin.",
    "selfRole": "You cannot change your own role.",
    "selfDisable": "You cannot disable yourself.",
    "password": "Password",
@@ -28,6 +28,12 @@
  "unshare": "Bỏ chia sẻ",
  "shareDone": "Đã chia sẻ lên Hub",
  "unshareDone": "Đã gỡ khỏi Hub",
+  "reshare": "Share lại",
+  "reshareDone": "Đã share bản mới — người đã cài sẽ thấy nút Cập nhật",
+  "reshareSame": "Đã là bản mới nhất — đã share",
+  "reshareAskTitle": "Chọn lại thư mục {{name}}",
+  "reshareAskBody": "Server không có bản của {{name}}. Chọn thư mục của skill (thư mục chứa SKILL.md): bản này sẽ được thay, và người đã cài sẽ thấy nút Cập nhật. Với file .zip, tải lên qua Thêm skill → Tải lên: skill trùng tên sẽ cập nhật mục bạn đã có.",
+  "resharePick": "Chọn thư mục",
  "open": "Mở",
  "copyLink": "Sao chép link",
  "preview": "Xem",
@@ -92,6 +92,7 @@
  "changes.expandFile": "Mở {{path}}",
  "changes.fileGone": "File này không còn thay đổi nào trong phạm vi đang xem.",
  "changes.fileTruncated": "Diff bị cắt bớt — mở file trong editor để xem phần còn lại.",
+  "changes.lineElided": "… còn {{size}} ký tự trên dòng này",
  "changes.commentLine": "Comment dòng {{n}} — dán vào pane của workspace này",
  "changes.commentOn": "Comment {{at}} — dán vào pane bạn dùng gần nhất; chưa gửi gì cho tới khi bạn nhấn Enter ở đó",
  "changes.commentSend": "Dán vào pane",
@@ -505,8 +506,6 @@
  "changes.loadMore": "Tải thêm commit",
  "changes.commentPasted": "Đã dán vào tab {{tab}} — nhấn Enter ở đó để gửi",
  "changes.splitter": "Đổi độ rộng khung thay đổi",
-  "tree.archiveLiveTitle": "Lưu trữ một session đang chạy?",
-  "tree.archiveLiveBody": "Tab của nó vẫn chạy; lưu trữ chỉ ẩn nó khỏi danh sách này. Bỏ lưu trữ trong mục đã lưu trữ.",
  "tree.state.awaiting": "đang chờ bạn",
  "tree.state.error": "lỗi",
  "tree.state.live": "đang chạy",
@@ -533,9 +532,9 @@
  "changes.unversionedGroup": "File chưa theo dõi",
  "changes.commitTicked": "Commit ({{count}})",
  "changes.commitAndPush": "Commit và Push",
-  "changes.discardAll": "Bỏ tất cả",
-  "changes.discardAllTitle": "Bỏ tất cả thay đổi?",
-  "changes.discardAllConfirm": "Mọi thay đổi trong {{count}} file sẽ trở về commit cuối, và {{untracked}} file mới chưa được git theo dõi sẽ bị xoá. Không thể hoàn tác.",
+  "changes.discardTicked": "Bỏ ({{count}})",
+  "changes.discardTickedTitle": "Bỏ các thay đổi đã chọn?",
+  "changes.discardTickedConfirm": "Các thay đổi đã chọn trong {{count}} file sẽ trở về commit cuối, và {{untracked}} file mới đã chọn chưa được git theo dõi sẽ bị xoá. File và đoạn không chọn được giữ nguyên. Không thể hoàn tác.",
  "changes.amendAndPush": "Amend và Push",
  "changes.pushFailed": "Đã commit, nhưng push thất bại: {{error}}",
  "changes.tickFile": "Đưa {{path}} vào commit",
@@ -1384,6 +1384,7 @@
    "noActive": "{{tool}} chưa có đăng nhập nào trên máy này.",
    "noProfiles": "Không tải được danh sách hồ sơ.",
    "switchSuccess": "Đã chuyển {{tool}} sang \"{{name}}\". Mở phiên mới để dùng.",
+    "switchFollowing": "Đã chuyển {{tool}} sang \"{{name}}\" — các phiên đang chạy theo luôn.",
    "deleteConfirmBody": "Thao tác này xoá đăng nhập {{tool}} đã lưu. Muốn dùng lại, hãy đăng nhập từ terminal và lưu lại lần nữa.",
    "loginHint": "Thêm đăng nhập {{tool}} khác bằng cách đăng nhập từ terminal trước:",
    "subtitle": {
@@ -79,6 +79,7 @@
    "EBADUSER": "Tên đăng nhập: chữ, số, '.', '_' hoặc '-' (tối đa 64 ký tự).",
    "EBADPASSWORD": "Mật khẩu không được để trống.",
    "EBADEMAIL": "Địa chỉ email không hợp lệ.",
+    "ENAMETAKEN": "Tên này đã có tài khoản khác dùng. Hãy chọn tên của chính bạn.",
    "EBADFIELD": "Có một giá trị không hợp lệ.",
    "ENOLANE": "Workspace đó không còn tồn tại.",
    "ENOTOWNED": "Workspace đó không còn thuộc người này.",
@@ -111,6 +112,8 @@
    "status": "Trạng thái",
    "active": "Đang hoạt động",
    "statusHint": "Người dùng bị vô hiệu hoá không thể đăng nhập; workspace và lịch sử vẫn được giữ.",
+    "hostAccount": "Sở hữu tài khoản host của máy chủ",
+    "hostAccountHint": "Session chạy bằng tài khoản Linux của máy chủ nhưng ngoài mọi workspace (claude -p của script, CLI trong terminal thường) được tính vào chi phí của admin này. Tối đa một admin; nếu chưa ai được chọn thì là admin duy nhất.",
    "selfRole": "Bạn không thể đổi vai trò của chính mình.",
    "selfDisable": "Bạn không thể tự vô hiệu hoá mình.",
    "password": "Mật khẩu",
@@ -800,6 +800,8 @@ export type UserPatch = {
  addWorkspaces?: number[];
  removeWorkspaces?: number[];
  signOut?: true;
+  /** Owns the host's Linux account: its sessions outside every workspace bill to them (admins only). */
+  hostAccount?: boolean;
  /** Their own spend quota (`default` = the default applies). */
  quota?: UserQuotaSetting;
 };
@@ -983,6 +985,8 @@ export type AuthUser = {
  createdAt?: string;
  /** An admin gave this password: the user must choose their own before anything else. */
  mustChangePassword?: boolean;
+  /** Owns the host's Linux account (server/lib/session-account.js) — absent from an older server. */
+  hostAccount?: boolean;
 };
 export type AuthState = { mode: "local" } | { mode: "server"; user: AuthUser | null };
 /** GET /api/me/prefs — the signed-in account's own UI preferences (localStorage keys). */
@@ -1401,7 +1405,7 @@ export const api = {
      ),
    /** POST /api/tool-profiles/:tool/activate — the outgoing login is saved back first. */
    activate: (tool: string, name: string) =>
-      request<{ ok: true; name: string; savedOutgoing: string | null }>(
+      request<{ ok: true; name: string; savedOutgoing: string | null; following?: boolean }>(
        `/tool-profiles/${encodeURIComponent(tool)}/activate`,
        { method: "POST", body: JSON.stringify({ name }) }
      ),
@@ -3320,16 +3324,17 @@ export const api = {
     *  several skills at once (one artifact each). `path` keeps a folder's layout. */
    uploadSkills: (
      files: { file: File; path: string }[],
-      fields: { name?: string; title?: string; description?: string } = {}
+      /** `id`: Share again — the upload replaces that skill row's version. */
+      fields: { name?: string; title?: string; description?: string; id?: string } = {}
    ) => {
      const form = new FormData();
      for (const f of files) form.append("files", f.file, f.file.name);
      form.append("paths", JSON.stringify(files.map((f) => f.path)));
      for (const [k, v] of Object.entries(fields)) if (v) form.append(k, v);
-      return request<{ items: Artifact[] }>("/artifacts/skill/upload", {
-        method: "POST",
-        body: form,
-      });
+      return request<{ items: (Artifact & { replaced?: boolean; changed?: boolean })[] }>(
+        "/artifacts/skill/upload",
+        { method: "POST", body: form }
+      );
    },
    /** One file from the user's computer, kept like a pinned one (≤ 25 MB). */
    uploadFile: (file: File, fields: { title?: string; description?: string } = {}) => {
@@ -3368,6 +3373,12 @@ export const api = {
        method: "PATCH",
        body: JSON.stringify(body),
      }),
+    /** POST /api/artifacts/:id/reshare — Share again: the owner's skill folder on
+     *  the server becomes the new version (409 ENOSOURCE when it has none). */
+    reshare: (id: number) =>
+      request<{ item: Artifact; changed: boolean }>(`/artifacts/${id}/reshare`, {
+        method: "POST",
+      }),
    /** `kept`: a shared one left your library but stays in the Hub. */
    remove: (id: number) =>
      request<{ ok: true; kept: boolean }>(`/artifacts/${id}`, { method: "DELETE" }),
@@ -6,7 +6,8 @@
 * message. Both ask first when any pane holds an AI agent (it may be
 * mid-turn); a plain shell holds no session, so it neither asks nor sleeps.
 * Used by the tab bar (`ConsoleTabs`), the split panes (`Workspace`) and a
- * session's right-click menu (`SessionMenu`).
+ * session's right-click menu (`SessionMenu`), and a live session's Archive
+ * (`WorkspaceSessionList`, `WorkspaceHome`) — archiving never leaves a pane running.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -2974,6 +2974,9 @@ export interface LaneDiffLine {
  /** Line number on the right (after) side; null on a removed line. */
  newLine: number | null;
  text: string;
+  /** Characters cut off the end of a very long row (a base64 blob, a minified
+   *  bundle): `text` holds only its start. Absent on a whole row. */
+  elided?: number;
 }

 /** `GET /api/lanes/:id/git/blame` — Annotate: who last changed each line of
@@ -28,7 +28,9 @@
 * **Installed** instead of the Install button; **Uninstall** (a skill's
 * copies moved aside, a plugin `claude plugin uninstall`) is offered only in
 * the card's ⋯ menu. A skill follows its owner's folder (the server takes a
- * change there as a new snapshot when the Hub is listed); an installed copy
+ * change there as a new snapshot when the Hub is listed; **Share again**
+ * takes its folder on the server — or a plugin's copy — on a click, else
+ * asks for the folder and uploads it onto the same row); an installed copy
 * that differs from the newest version shows **Update** (a pack: "Update N"),
 * which replaces it after a confirmation, the old copy moved aside. Editing a skill
 * edits its SKILL.md (name, description, instructions — a new snapshot);
@@ -277,6 +279,53 @@ export function Artifacts() {
    }
  };

+  // Share again: the server's copy of the skill, else the folder picked again
+  // (uploaded onto the same row). Either way installers are offered Update.
+  const reshareInput = useRef<HTMLInputElement>(null);
+  const reshareRow = useRef<Artifact | null>(null);
+  useEffect(() => {
+    reshareInput.current?.setAttribute("webkitdirectory", "");
+  }, []);
+  const reshared = (changed: boolean) => {
+    toast.success(t(changed ? "reshareDone" : "reshareSame"));
+    load();
+  };
+  const reshare = async (a: Artifact) => {
+    try {
+      const r = await api.artifacts.reshare(a.id);
+      reshared(r.changed);
+    } catch (err) {
+      if ((err as { code?: string }).code !== "ENOSOURCE") return toast.error(err);
+      if (
+        !(await confirmDialog({
+          title: t("reshareAskTitle", { name: a.source ?? a.title }),
+          message: t("reshareAskBody", { name: a.source ?? a.title }),
+          confirmLabel: t("resharePick"),
+        }))
+      )
+        return;
+      reshareRow.current = a;
+      reshareInput.current?.click();
+    }
+  };
+  const reshareUpload = async (list: FileList | null) => {
+    const a = reshareRow.current;
+    reshareRow.current = null;
+    if (!a || !list?.length) return;
+    try {
+      const r = await api.artifacts.uploadSkills(
+        Array.from(list).map((file) => ({
+          file,
+          path: (file as File & { webkitRelativePath?: string }).webkitRelativePath || file.name,
+        })),
+        { id: String(a.id) }
+      );
+      reshared(r.items.some((i) => i.changed !== false));
+    } catch (err) {
+      toast.error(err);
+    }
+  };
+
  const [renaming, setRenaming] = useState<Artifact | null>(null);

  const remove = async (a: Artifact) => {
@@ -442,6 +491,7 @@ export function Artifacts() {
  const actionsFor = (a: Artifact): CardActions => ({
    onOpen: () => setDetailId(a.id),
    onShare: () => void share(a),
+    onReshare: () => void reshare(a),
    onRename: () => {
      setDetailId(null);
      setRenaming(a);
@@ -572,6 +622,17 @@ export function Artifacts() {

  return (
    <div className="animate-fade-in space-y-5" data-testid="artifacts-page">
+      <input
+        ref={reshareInput}
+        type="file"
+        multiple
+        hidden
+        data-testid="artifact-reshare-folder"
+        onChange={(e) => {
+          void reshareUpload(e.target.files);
+          e.target.value = "";
+        }}
+      />
      <div className="flex items-start justify-between gap-3">
        <div className="min-w-0">
          <h1 className="text-lg font-semibold text-fg-primary">{t("title")}</h1>
@@ -1066,6 +1127,8 @@ function EmptyState({
 type CardActions = {
  onOpen: () => void;
  onShare: () => void;
+  /** A skill of your own: its newest version, shared (installers get Update). */
+  onReshare: () => void;
  onRename: () => void;
  onDelete: () => void;
  onInstall: () => void;
@@ -1237,6 +1300,7 @@ function ArtifactMenu({
  menu,
  onOpen,
  onShare,
+  onReshare,
  onRename,
  onDelete,
  onInstall,
@@ -1297,6 +1361,9 @@ function ArtifactMenu({
              {t(hubOnly ? "hubRemove" : a.shared ? "unshare" : "share")}
            </MenuItem>
          )}
+          {server && a.kind === "skill" && (
+            <MenuItem onSelect={pick(onReshare)}>{t("reshare")}</MenuItem>
+          )}
          <MenuItem onSelect={pick(onRename)}>{t("rename")}</MenuItem>
          {!hubOnly && (
            <MenuItem danger onSelect={pick(onDelete)}>
@@ -1447,6 +1514,7 @@ function DetailDialog({
  canInstall,
  onClose,
  onShare,
+  onReshare,
  onRename,
  onDelete,
  onInstall,
@@ -1611,6 +1679,11 @@ function DetailDialog({
                {t(hubOnly ? "hubRemove" : a.shared ? "unshare" : "share")}
              </button>
            )}
+            {server && a.kind === "skill" && (
+              <button type="button" className={secondary} onClick={onReshare}>
+                {t("reshare")}
+              </button>
+            )}
            <button type="button" className={secondary} onClick={onRename}>
              {t("rename")}
            </button>
@@ -46,6 +46,7 @@ vi.mock("../../lib/api", () => ({
      addPlugin: vi.fn(),
      inspectMarket: vi.fn(),
      uploadSkills: vi.fn(),
+      reshare: vi.fn(),
      writeSkill: vi.fn(),
      uploadFile: vi.fn(),
      candidates: vi.fn(),
@@ -394,6 +395,47 @@ describe("Artifacts", () => {
    expect(calls[calls.length - 1]?.[0].title).toMatch(/Remove “hub-only” from the Hub/);
  });

+  it("Share again takes the server's copy, else uploads the picked folder onto that skill", async () => {
+    vi.mocked(api.artifacts.uploadSkills).mockClear();
+    vi.mocked(api.artifacts.settings).mockResolvedValue({
+      serverMode: true,
+      canShare: true,
+      installsEnabled: true,
+      canManage: true,
+    });
+    vi.mocked(api.artifacts.list).mockResolvedValue({
+      items: [item({ id: 2, kind: "skill", title: "sg-flow", source: "sg-flow", shared: true })],
+    });
+    vi.mocked(api.artifacts.reshare).mockResolvedValueOnce({
+      item: item({ id: 2 }),
+      changed: true,
+    });
+    const user = userEvent.setup();
+    open();
+    const card = await screen.findByTestId("artifact-2");
+    await menuAction(user, "Share again", card);
+    await waitFor(() => expect(api.artifacts.reshare).toHaveBeenCalledWith(2));
+    expect(api.artifacts.uploadSkills).not.toHaveBeenCalled();
+
+    // No copy on the server: the folder is asked for and lands on THIS row.
+    vi.mocked(api.artifacts.reshare).mockRejectedValueOnce(
+      Object.assign(new Error("no copy"), { code: "ENOSOURCE" })
+    );
+    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
+    vi.mocked(api.artifacts.uploadSkills).mockResolvedValueOnce({
+      items: [{ ...item({ id: 2 }), changed: true }],
+    });
+    await menuAction(user, "Share again", card);
+    await waitFor(() => expect(confirmDialog).toHaveBeenCalled());
+    const md = new File(["---\nname: sg-flow\n---\n"], "SKILL.md");
+    await user.upload(screen.getByTestId("artifact-reshare-folder"), md);
+    await waitFor(() =>
+      expect(api.artifacts.uploadSkills).toHaveBeenCalledWith([{ file: md, path: "SKILL.md" }], {
+        id: "2",
+      })
+    );
+  });
+
  it("offers Update for an installed skill its owner changed, after a confirmation", async () => {
    vi.mocked(api.artifacts.list).mockResolvedValue({
      items: [
@@ -7316,7 +7316,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                <span
                  class="text-status-warning/90"
                >
-                  UI build v2.8.38 (rebuild client to match)
+                  UI build v2.8.45 (rebuild client to match)
                </span>
              </p>
            </div>
@@ -89,9 +89,9 @@ A dashboard shared by several people runs in **server mode** ([SERVER-MODE.md](S
 | `POST /api/auth/login` `{username, password}` | `{user}` + the cookie; `401 EBADLOGIN`, `429 ETOOMANY`, `404 ENOTSERVER` in local mode |
 | `POST /api/auth/logout` | `{ok: true}`, cookie cleared |

-In server mode a **developer** sees only rows of the workspaces they own (`lanes.owner_id`): every list, count, chart and cost answer is limited to them, and a request naming another user's session, agent, workspace or run (in the path, query or body) answers `404 ENOTFOUND`. Admin and analyst see everything; `GET /api/users` lists every account (`displayName`, `email`, `createdAt`, `logins`, `lastLoginAt` — the last login ever, kept after it ends —, `mustChangePassword` included) with its workspaces, sessions and `today` (since the viewer's local midnight — `?tz_offset=` is the browser's `getTimezoneOffset()`, UTC without it) / 7 / 30-day `{cost, tokens}`, `GET /api/users/storage[?refresh=1]` each user's home size (`{storage: {<id>: {bytes, files, partial, measuredAt} | null}, measuring}` — measured in the background, see [SERVER-MODE.md](SERVER-MODE.md)), `GET /api/users/tmux` each member's own tmux server under one Linux user per account (`{available, installed, matched, users: [{id, username, running, stuck?, version, pid, startedAt, sessions, busy, outdated}]}`; an admin's `POST /api/users/:id/tmux-restart` and `POST /api/users/tmux-restart-idle` restart them with `currentPassword`, audited, `409 ETMUXSTUCK` for a server that will not stop), `GET /api/host` the machine and each user's live share of it (`{at, hostname, os, uptime, cpu: {model, cores, load}, memory: {total, available, used, swapTotal, swapUsed}, disks: [{device, mount, type, kind: "HDD"|"SSD"|null, total, used, free}], homesMount, gpus: [{name, utilization, memoryUsed, memoryTotal}], usage: {cpu, sampleMs, groups: [{key, kind: "user"|"host"|"system", userId?, username?, cpu, memory, memoryPercent, processes, top: [{pid, name, cpu, memory}]}]} | null, bootTime, network: [{name, rx, tx}], diskIo: [{name, read, write}], temperatures: [{chip, label, celsius}], pressure: {cpu, memory, io: {some10, some60, full10} | null} | null (Linux PSI, `/proc/pressure/*`: % of the last 10 / 60 s tasks stalled on it), topProcesses: [{pid, name, cpu, memory, group}], process: {pid, node, uptime, rss, heapUsed}}`, `cpu` also carrying `physicalCores` and `perCore` (busy % per thread), rates in bytes/s over the sample — read-only, cached 3 s, `usage` null and the lists empty off Linux), `GET /api/host/history?range=1h|6h|24h` the CPU/memory history every server on Linux keeps in memory since it started (both read by the Dashboard's System Health tab and open to every signed-in user — `/host` is not staff-only) (`{range, intervalMs, running, startedAt, points: [{at, cpu, memory, memoryUsed, swapUsed, load1, users: {<id>: {cpu, memory}}}]}`, one point per 30 s, averaged to ≤ 360), `GET /api/users/:id/details[?tz_offset=]` one account in full for the Administration page's user detail (`{user (with logins, lastLoginAt), sessions: {total, active, firstAt, lastAt}, usage: {today, last7d, last30d, daily: [{date, cost, tokens}] (30 local days, oldest first), byTool, byModel: [{key, cost, tokens, sessions}]}, workspaces: [{id, title, cwd, tool, kind, branch, status, createdAt, sessions, lastActiveAt, livePanes}], panes: [{id, laneId, laneTitle, laneCwd, tool, model, account, proxy, sessionId, startedAt, status}], recentSessions (15, with cost/tokens), pool: {claude|codex|cursor: {pin, group, accounts: [{name, kind, email, expired, allowed, pinned, quota, quotaPercent, full, livePanes, spend5h, spend7d, userSpend5h, userSpend7d, userTokens5h, userTokens7d, userRuns7d, userLivePanes, userLastAt}]}}, audit}` — `user*` fields are only the runs on that user's workspaces; never a token; `404 ENOUSER`), and `GET /api/users/audit[?limit=]` the staff reads of developers' sessions and admins' account changes (kept `AGENTHUB_AUDIT_DAYS` days, default 180, `0` = forever) (`reader`/`owner` are usernames, `reader_display`/`owner_display` their display names or null) (all `403 EADMIN` for a developer). `GET /api/users` also carries each account's [spend quota](SERVER-MODE.md#spend-quotas) — `quotaSetting` (`{mode: "default"|"unlimited"|"custom", limit_usd?, period?, tz_offset?}`) and `quota` (the one binding them now with `spend`, `pct`, `exceeded`, `resetsAt`, or null) — and the top-level `quotaDefault`; an admin sets the default with `PUT /api/users/quota-default` `{quota: {limit_usd, period, tz_offset} | null, currentPassword}` and a user's own with `PATCH /api/users/:id` `{quota}` (`400 EBADQUOTA`). A workspace owner over their quota gets `429 EQUOTA` from `POST /api/run` and `POST /api/lanes/:id/start`. See [SERVER-MODE.md](SERVER-MODE.md#what-each-user-sees).
+In server mode a **developer** sees only rows of the workspaces they own (`lanes.owner_id`): every list, count, chart and cost answer is limited to them, and a request naming another user's session, agent, workspace or run (in the path, query or body) answers `404 ENOTFOUND`. Admin and analyst see everything; `GET /api/users` lists every account (`displayName`, `email`, `createdAt`, `logins`, `lastLoginAt` — the last login ever, kept after it ends —, `mustChangePassword` included) with its workspaces, sessions and `today` (since the viewer's local midnight — `?tz_offset=` is the browser's `getTimezoneOffset()`, UTC without it) / 7 / 30-day `{cost, tokens}`, `GET /api/users/storage[?refresh=1]` each user's home size (`{storage: {<id>: {bytes, files, partial, measuredAt} | null}, measuring}` — measured in the background, see [SERVER-MODE.md](SERVER-MODE.md)), `GET /api/users/tmux` each member's own tmux server under one Linux user per account (`{available, installed, matched, users: [{id, username, running, stuck?, version, pid, startedAt, sessions, busy, outdated}]}`; an admin's `POST /api/users/:id/tmux-restart` and `POST /api/users/tmux-restart-idle` restart them with `currentPassword`, audited, `409 ETMUXSTUCK` for a server that will not stop), `GET /api/host` the machine and each user's live share of it (`{at, hostname, os, uptime, cpu: {model, cores, load}, memory: {total, available, used, swapTotal, swapUsed}, disks: [{device, mount, type, kind: "HDD"|"SSD"|null, total, used, free}], homesMount, gpus: [{name, utilization, memoryUsed, memoryTotal}], usage: {cpu, sampleMs, groups: [{key, kind: "user"|"host"|"system", userId?, username?, displayName?, avatarAt?, cpu, memory, memoryPercent, processes, top: [{pid, name, cpu, memory}]}]} | null, bootTime, network: [{name, rx, tx}], diskIo: [{name, read, write}], temperatures: [{chip, label, celsius}], pressure: {cpu, memory, io: {some10, some60, full10} | null} | null (Linux PSI, `/proc/pressure/*`: % of the last 10 / 60 s tasks stalled on it), topProcesses: [{pid, name, cpu, memory, group}], process: {pid, node, uptime, rss, heapUsed}}`, `cpu` also carrying `physicalCores` and `perCore` (busy % per thread), rates in bytes/s over the sample — read-only, cached 3 s, `usage` null and the lists empty off Linux), `GET /api/host/history?range=1h|6h|24h` the CPU/memory history every server on Linux keeps in memory since it started (both read by the Dashboard's System Health tab and open to every signed-in user — `/host` is not staff-only) (`{range, intervalMs, running, startedAt, points: [{at, cpu, memory, memoryUsed, swapUsed, load1, users: {<id>: {cpu, memory}}}]}`, one point per 30 s, averaged to ≤ 360), `GET /api/users/:id/details[?tz_offset=]` one account in full for the Administration page's user detail (`{user (with logins, lastLoginAt), sessions: {total, active, firstAt, lastAt}, usage: {today, last7d, last30d, daily: [{date, cost, tokens}] (30 local days, oldest first), byTool, byModel: [{key, cost, tokens, sessions}]}, workspaces: [{id, title, cwd, tool, kind, branch, status, createdAt, sessions, lastActiveAt, livePanes}], panes: [{id, laneId, laneTitle, laneCwd, tool, model, account, proxy, sessionId, startedAt, status}], recentSessions (15, with cost/tokens), pool: {claude|codex|cursor: {pin, group, accounts: [{name, kind, email, expired, allowed, pinned, quota, quotaPercent, full, livePanes, spend5h, spend7d, userSpend5h, userSpend7d, userTokens5h, userTokens7d, userRuns7d, userLivePanes, userLastAt}]}}, audit}` — `user*` fields are only the runs on that user's workspaces; never a token; `404 ENOUSER`), and `GET /api/users/audit[?limit=]` the staff reads of developers' sessions and admins' account changes (kept `AGENTHUB_AUDIT_DAYS` days, default 180, `0` = forever) (`reader`/`owner` are usernames, `reader_display`/`owner_display` their display names or null) (all `403 EADMIN` for a developer). `GET /api/users` also carries each account's [spend quota](SERVER-MODE.md#spend-quotas) — `quotaSetting` (`{mode: "default"|"unlimited"|"custom", limit_usd?, period?, tz_offset?}`) and `quota` (the one binding them now with `spend`, `pct`, `exceeded`, `resetsAt`, or null) — and the top-level `quotaDefault`; an admin sets the default with `PUT /api/users/quota-default` `{quota: {limit_usd, period, tz_offset} | null, currentPassword}` and a user's own with `PATCH /api/users/:id` `{quota}` (`400 EBADQUOTA`). A workspace owner over their quota gets `429 EQUOTA` from `POST /api/run` and `POST /api/lanes/:id/start`. See [SERVER-MODE.md](SERVER-MODE.md#what-each-user-sees).

-An admin changes accounts with `POST /api/users` (`{username, password, role}` → `201 {user}`; the password may be any non-empty starting one and the account gets `mustChangePassword: true`), `GET /api/users/:id` (`{user, workspaces: [{id, title, cwd}]}`, the account with `logins` and `lastLoginAt`, for the Edit form; admin or analyst), `GET /api/users/:id/avatar` (that account's picture for the sidebar's owner groups — admin or analyst, `nosniff` + `sandbox` CSP, `404 ENOAVATAR`; a workspace in `GET /api/lanes` carries `owner_avatar_at` to version its URL), `PATCH /api/users/:id` (any of `{displayName?, email?, role?, disabled?, password?, addWorkspaces?: [laneId], removeWorkspaces?: [laneId], signOut?: true}` — every field validated before any is written; `removeWorkspaces` leaves the workspace with no owner and answers `409 ENOTOWNED` for one the user does not own; an admin's own `password`/`signOut` keeps the login it came from; a password for SOMEONE ELSE may be anything non-empty and sets their `mustChangePassword`, the admin's OWN must pass every rule below, `400 EWEAKPASSWORD` with `rules`), `POST /api/users/:id/password` (`{password}`; that user's logins end; the same two bars) `POST /api/users/:id/workspaces` (`{laneId}`; the workspace's owner becomes that user) and `DELETE /api/users/:id` (delete for good: the user's logins, panes, workspaces' records, prefs and — under S3 — their Linux account and whole home, removed FIRST so a refusal (`502 EPROVISION`) leaves every row; `409 ESELF` for yourself, `409 ELASTADMIN` for the last admin; session history and the audit log stay). No path — this API or the `agenthub users` CLI — may demote, disable or delete the last enabled admin (`409 ELASTADMIN`). Every one carries `currentPassword`, the admin's own password: `403 EREAUTH` when it is wrong or missing, `429 ETOOMANY` after 10 wrong tries in 15 minutes. `409 ESELF` for an admin's own role or disable, `409 EEXISTS` for a taken name, `400 EBADUSER`/`EBADPASSWORD`/`EBADROLE`/`EBADEMAIL`/`EBADFIELD`, `404 ENOUSER`/`ENOLANE`; a developer or analyst gets `403 EADMIN`, and local mode `403 ELOCALMODE`. No answer carries a password hash; each change is written to the audit log.
+An admin changes accounts with `POST /api/users` (`{username, password, role}` → `201 {user}`; the password may be any non-empty starting one and the account gets `mustChangePassword: true`), `GET /api/users/:id` (`{user, workspaces: [{id, title, cwd}]}`, the account with `logins` and `lastLoginAt`, for the Edit form; admin or analyst), `GET /api/users/:id/avatar` (that account's picture for the sidebar's owner groups — admin or analyst, `nosniff` + `sandbox` CSP, `404 ENOAVATAR`; a workspace in `GET /api/lanes` carries `owner_avatar_at` to version its URL), `PATCH /api/users/:id` (any of `{displayName?, email?, role?, disabled?, password?, addWorkspaces?: [laneId], removeWorkspaces?: [laneId], signOut?: true}` — every field validated before any is written; `removeWorkspaces` leaves the workspace with no owner and answers `409 ENOTOWNED` for one the user does not own; an admin's own `password`/`signOut` keeps the login it came from; a password for SOMEONE ELSE may be anything non-empty and sets their `mustChangePassword`, the admin's OWN must pass every rule below, `400 EWEAKPASSWORD` with `rules`), `POST /api/users/:id/password` (`{password}`; that user's logins end; the same two bars) `POST /api/users/:id/workspaces` (`{laneId}`; the workspace's owner becomes that user) and `DELETE /api/users/:id` (delete for good: the user's logins, panes, workspaces' records, prefs and — under S3 — their Linux account and whole home, removed FIRST so a refusal (`502 EPROVISION`) leaves every row; `409 ESELF` for yourself, `409 ELASTADMIN` for the last admin; session history and the audit log stay). No path — this API or the `agenthub users` CLI — may demote, disable or delete the last enabled admin (`409 ELASTADMIN`). Every one carries `currentPassword`, the admin's own password: `403 EREAUTH` when it is wrong or missing, `429 ETOOMANY` after 10 wrong tries in 15 minutes. `409 ESELF` for an admin's own role or disable, `409 EEXISTS` for a taken name, `409 ENAMETAKEN` for a `displayName` that reads as another account's (the same rule as `PATCH /api/me/account`), `400 EBADUSER`/`EBADPASSWORD`/`EBADROLE`/`EBADEMAIL`/`EBADFIELD`, `404 ENOUSER`/`ENOLANE`; a developer or analyst gets `403 EADMIN`, and local mode `403 ELOCALMODE`. No answer carries a password hash; each change is written to the audit log.

 `GET /api/accounts[?force=1]` lists the Claude account pool ([SERVER-MODE.md](SERVER-MODE.md#claude-account-pool)): `{accounts: [{name, addedAt, expiresAt, expired, livePanes, spend5h, spend7d, tokens5h, tokens7d, quota: {fiveHour, sevenDay, checkedAt, error} | null, quotaPercent, full}], codex: [{name, kind: "apikey"|"chatgpt", addedAt, livePanes, spend5h, spend7d, tokens5h, tokens7d, quota: {windows: [{label, usedPercent, resetsAt}], asOf} | null, quotaPercent, full}], pins: {claude: [{userId, username, account, pinnedAt}], codex: […]}, blockPercent}` — `pins` are the users an admin pinned to one account (empty in local mode, keyed by tool: `claude`, `codex`, `cursor`); `codex` is the [Codex account pool](SERVER-MODE.md#codex-account-pool); `cursor: [{name, kind: "apikey", addedAt, livePanes, …}]` is the [Cursor account pool](SERVER-MODE.md#cursor-account-pool) (API keys; `quota` null, spend 0); `groups: [{id, name, createdAt, users: [{userId, username}], accounts: {claude: [names], codex: […], cursor: […]}}]` are the [pool groups](SERVER-MODE.md#account-pool-groups) (empty in local mode). `spend*`/`tokens*` = the sessions the account's runs held, over the hours they held them (a Codex session counts whole once its run started in the window). It never includes a key or a token. `force=1` re-reads every quota first. Run rows (`/api/run/history`) carry `account`, the pool account their pane ran on (`null` = the machine's own login).

@@ -110,7 +110,7 @@ An admin (server mode) adds an account with `POST /api/accounts` `{tool: "claude
 | `PUT /api/me/pool-accounts` `{tool, account: "<name>" \| null}` | the account's new sessions of `tool` run on `account` (`null` = automatic): `{tool, choice, switched}` — `switched` as for an admin's pin (a Claude login goes into the home at once). Below an admin's pin (`409 ELOCKED`), only an account the group allows (`404 ENOACCOUNT`), `400 EBADTOOL`; login cookie only, audited |
 | `POST /api/me/onboarded` | the first-run setup is done or skipped (kept from the first call) |
 | `GET /api/me/account` | Settings → Account. Server mode: `{mode: "server", user: {id, username, role, disabled, displayName, email, avatarAt, createdAt}, workspaces, sessions, logins, lastLoginAt}`; local mode `{mode: "local"}` |
-| `PATCH /api/me/account` `{displayName?, email?}` | the account's own profile (`""`/`null` clears), the same shape back; `400 EBADFIELD` (display name over 100 characters or with control characters) / `EBADEMAIL` |
+| `PATCH /api/me/account` `{displayName?, email?}` | the account's own profile (`""`/`null` clears), the same shape back; `400 EBADFIELD` (display name over 100 characters or with control characters) / `EBADEMAIL`; `409 ENAMETAKEN` for a display name that reads as another account's display name or username (marks, case, punctuation, bracketed parts like "(you)" and look-alike letters ignored; keeping the name you have is always allowed) |
 | `POST /api/me/password` `{currentPassword, newPassword}` | `{ok: true}`; every other login of the account ends, this one stays, and `mustChangePassword` clears. The new password must pass every rule — at least 8 characters, a lower-case and an upper-case letter, a digit, a symbol, not containing the username — and differ from the current one: `400 EWEAKPASSWORD` with `error.rules` (`length`, `lower`, `upper`, `digit`, `symbol`, `username`, `reused`). `403 EREAUTH` wrong current password (`429 ETOOMANY` after 10), `400 EBADPASSWORD` |
 | `POST /api/me/sign-out-others` | `{ended}` — every login of the account but this one ends |
 | `GET /api/me/avatar` | server mode: the account's own picture (`nosniff`, `sandbox` CSP; the client adds `?v=<avatarAt>`), `404 ENOAVATAR` when it has none |
@@ -817,6 +817,11 @@ that file.
 - Three caps guard the response: **300** files listed, **200 KB** of patch per
  file, **1 MB** of patch in a `full` read. A cap that bit sets `truncated` on
  the response and on the file it cut.
+- A row longer than **4,000** characters (an inlined base64 image or video, a
+  minified bundle) comes back cut to its first 1,000 with `elided: <characters
+  hidden>`, BEFORE the per-file cap is applied, so one huge line no longer eats
+  the hunks after it. Each file's raw patch is read up to 16 M characters; past
+  that it is still `truncated`.
 - Read-only, no same-origin guard. `available: false` (HTTP **200**) for a cwd
  git cannot read; `range=branch` compares against the workspace's base branch,
  else the repo's default branch (what `origin/HEAD` names, else `main`/`master`)
@@ -1058,7 +1063,7 @@ cannot collide on `index.lock`.
 | `push` | `git push -u <remote> HEAD` — the branch's upstream remote, else the only remote, else `origin`, else `400 ENOREMOTE` | — |
 | `stage` | `git add -- <paths>` | `{"paths": ["..."]}` |
 | `unstage` | `git restore --staged -- <paths>` (a staged rename also passes its original path, so both halves unstage) | `{"paths": ["..."]}` |
-| `discard` | `git restore --source=HEAD --staged --worktree` (tracked) / `git clean -fd` (untracked) | `{"paths": ["..."], "confirm": true}` |
+| `discard` | `git restore --source=HEAD --staged --worktree` (tracked) / `git clean -fd` (untracked); with `hunks` (a partly ticked file's ticked change blocks, named as in `commit`), `git apply -R` of only those blocks off the working tree first — every patch built before any is applied, so a stale one is `409 EHUNKGONE` with nothing undone | `{"paths": ["..."], "confirm": true}` / `{"paths": [], "hunks": {"<path>": [{"hunk": "@@ … @@", "blocks": [0]}]}, "context": 3, "confirm": true}` |
 | `stage-hunk` | `git apply --cached` of ONE hunk of `git diff -U<context> HEAD -- <path>` — or, with `block`, of only that hunk's `block`-th run of +/- lines (the other runs folded into context, as an edited `git add -p` hunk) | `{"path": "...", "hunk": "@@ -1,2 +1,3 @@", "block": 0, "context": 3}` |
 | `discard-hunk` | `git apply -R` of that one hunk (or that one `block` of it), off the working tree | `{"path": "...", "hunk": "@@ ... @@", "block": 0, "context": 3, "confirm": true}` |
 | `commit` | `git add -A` then `git commit -m <message>`, or the index as it stands with `only: "staged"`, or — with `paths` — `git commit --only -- <paths>`: exactly those files' working-tree content (an untracked one is added first, and taken back out if the commit fails), every other change left as it was | `{"message": "...", "only": "staged"}` / `{"message": "...", "paths": ["..."]}` |
@@ -3036,7 +3041,7 @@ POST /api/tool-profiles/:tool/activate   Body: { name }
 DELETE /api/tool-profiles/:tool          Body: { name }
 ```

-The login profiles of the AI tools other than Claude Code (`server/lib/tool-profiles.js`; Claude's are `/api/cc-config/profiles` above). Settings → AI tools → **Profiles** shows both, one tab per tool. `:tool` is `codex` (the whole `$CODEX_HOME/auth.json`: a ChatGPT login or an API key) or `omp` (every credential Oh My Pi stores, read with `omp auth export` and written back with `omp auth import -` — secrets on stdin, never argv; import merges, so a switch first empties omp's credential tables in `~/.omp/agent/agent.db`, and a failed import puts the outgoing set back). `antigravity` is listed with `supported: false` and a `reason`: agy keeps its login in the OS keyring, which AgentHub does not touch (`409 EUNSUPPORTED`). `GET /` answers `{tools: [{tool, supported, reason?, items, active, error?}]}`, each item `{name, label, savedAt, active, kind, email, detail}` — never a token; one tool's failure (omp not installed) is that tool's `error`, not the request's. Profiles are stored one file each under `<CLAUDE_HOME>/agenthub-profiles/<tool>/` (0700/0600) with cc-profiles' rules: one login is one profile (`409 EDUPLICATE`), a switch re-saves the outgoing login into its own profile first and refuses one never saved (`409 EUNSAVED`), the live login's profile is not deletable (`409 EACTIVE`), `409 ENOAUTH` when the tool holds no login, `409 ENOTINSTALLED`, `502 EOMP` when omp's own command fails. Writes are same-origin only; in server mode `/tool-profiles` is in `ADMIN_WRITE_PREFIXES` and `STAFF_ONLY_PREFIXES` — it changes the HOST's own logins.
+The login profiles of the AI tools other than Claude Code (`server/lib/tool-profiles.js`; Claude's are `/api/cc-config/profiles` above). Settings → AI tools → **Profiles** shows both, one tab per tool. `:tool` is `codex` (the whole `$CODEX_HOME/auth.json`: a ChatGPT login or an API key) or `omp` (every credential Oh My Pi stores, read with `omp auth export` and written back with `omp auth import -` — secrets on stdin, never argv; import merges, so a switch first empties omp's credential tables in `~/.omp/agent/agent.db`, and a failed import puts the outgoing set back). `antigravity` is listed with `supported: false` and a `reason`: agy keeps its login in the OS keyring, which AgentHub does not touch (`409 EUNSUPPORTED`). `GET /` answers `{tools: [{tool, supported, reason?, items, active, error?}]}`, each item `{name, label, savedAt, active, kind, email, detail}` — never a token; one tool's failure (omp not installed) is that tool's `error`, not the request's. Profiles are stored one file each under `<CLAUDE_HOME>/agenthub-profiles/<tool>/` (0700/0600) with cc-profiles' rules: one login is one profile (`409 EDUPLICATE`), a switch re-saves the outgoing login into its own profile first and refuses one never saved (`409 EUNSAVED`), and for Codex then runs `codex app-server daemon restart` when that CODEX_HOME's shared daemon is running (its `app-server-control.sock` resolves) — the daemon holds the login it started with, so without it neither an open nor a NEW Codex session saw the switch; open TUIs reconnect on their own — answering `following: true` (the activate response's extra field; `false` when no daemon ran), the live login's profile is not deletable (`409 EACTIVE`), `409 ENOAUTH` when the tool holds no login, `409 ENOTINSTALLED`, `502 EOMP` when omp's own command fails. Writes are same-origin only; in server mode `/tool-profiles` is in `ADMIN_WRITE_PREFIXES` and `STAFF_ONLY_PREFIXES` — it changes the HOST's own logins.

 ### AI Proxy profiles

@@ -3151,7 +3156,7 @@ POST   /api/artifacts/page                     {url, title?, description?}
 POST   /api/artifacts/file                     {laneId, path, title?, sessionId?}
 POST   /api/artifacts/file/upload              multipart: files (one), title?, description? → {item}
 POST   /api/artifacts/skill                    {name, laneId?, title?, description?}
-POST   /api/artifacts/skill/upload             multipart: files, paths (JSON, each file's relative path), name?, title?, description? → {items}
+POST   /api/artifacts/skill/upload             multipart: files, paths (JSON, each file's relative path), name?, title?, description?, id? → {items} — a skill named like one the caller already has becomes its new version (`replaced`, `changed`); `id` = Share again onto that row
 POST   /api/artifacts/skill/new                {name, description, content, title?} → {item, items}
 POST   /api/artifacts/plugin/inspect           {market} → {market, name, description, plugins: [{name, key, description, version, category}]}
 POST   /api/artifacts/plugin                   {key: "name@marketplace", market: "owner/repo" | git URL | marketplace.json URL, title?, description?}
@@ -3161,6 +3166,7 @@ DELETE /api/artifacts/:id                      {ok, kept} — kept: a shared row
 GET    /api/artifacts/:id/raw?path=&download=1 one snapshot file (sandbox CSP, nosniff)
 POST   /api/artifacts/:id/install              {replace?, update?} → {installed, replaced?}
 POST   /api/artifacts/:id/uninstall            → {uninstalled, paths}
+POST   /api/artifacts/:id/reshare              → {item, changed} — Share again (skill, owner): the owner's folder on this server becomes the new version and the row is shared; 409 ENOSOURCE when the server has no copy
 GET    /api/artifacts/:id/installs             {items: [{user, mine, at, replaced, paths?}], unrecorded}
 POST   /api/artifacts/:id/claim                → {item} — the suggested user, or an admin
 POST   /api/artifacts/:id/decline              → {id, declined} — the suggested user
@@ -3172,6 +3178,7 @@ What agents produced, per OWNER (`server/lib/artifacts.js`, plan: `docs/plans/ar
 - **page** — a claude.ai link (`https://claude.ai/…` only, `400 EBADURL`), one row per owner and link. A session's `Artifact` tool publish — or a Claude Docs `batch` that creates a doc (`container.create`; its title is the doc's name, later batches are skipped) — is captured from its PostToolUse hook (a doc's own `frame.artifactUrl`; for a publish the first `https://claude.ai/…artifact/…` in `tool_response`), owned by the session's workspace owner — or, for a session no workspace owns (a member's `claude` started from their own terminal under S3), by the member whose account sent the hook (by its connection's uid, never the body); the host account names nobody, so such a page from the host stays unowned, with `suggested_owner_id` set to the owner of the workspace whose folder holds the session's `cwd` (else, under S3, the member whose home it is).
 - **file** — `candidates` are the documents (html, md, pdf, images, csv, office…) the workspace's sessions wrote with Write/Edit/MultiEdit/NotebookEdit, inside its folder. **Captured at Stop:** when a session a workspace owns sends `Stop` or `SessionEnd`, each `.pptx`/`.docx`/`.xlsx`/`.pdf`/`.html` in the workspace it created or changed since it started (a repo's untracked or modified files — an HTML file only when untracked — or a plain folder's files; at most 20 per stop, ≤ 25 MB) is snapshotted into the workspace owner's library as `auto: true` (shown **Auto**), off the hook's response path. The same file at the mtime its snapshot recorded is skipped; a changed one replaces that row's snapshot; a file pinned by hand is left alone. A pin is read under the download route's guards (`lanePath`, `resolveInLane`, `ESECRET`, ≤ 25 MB, `413 ETOOBIG`) and SNAPSHOTTED to `<data dir>/artifacts/<random>/`.
 - **skill** — the caller's own `~/.claude/skills/<name>` (their member home under S3; the host's for an admin or in local mode, else `409 ENOACCOUNT`) or a workspace's `.claude/skills/<name>`. Snapshotted whole: ≤ 300 files, ≤ 5 MB, a symlink anywhere is `ESYMLINK`, a secret-looking file name (`.env`, `*.pem`, `id_rsa`, `.netrc`…, or a data file named `*token*`/`*secret*`/`*password*`/`*credential*` — the word alone does not count in Markdown, source code or images, e.g. `design-tokens.md`) `403 ESECRET`.
+- **Share again** (a skill's ⋯ menu and detail sheet, its owner, server mode) — `reshare` takes the owner's skill folder on THIS server as the new snapshot: the row's source folder, else the same-named `skills/<name>` of a plugin the owner installed at user scope (`installed_plugins.json`, the most recently updated one, never outside their `~/.claude/plugins/`), and shares the row; installers are then offered **Update**. With no copy on the server (a skill uploaded from a browser) it answers `409 ENOSOURCE` and the page asks for the skill's folder, uploaded with `id` onto that row. An upload whose skill is named like one the uploader already has (not a workspace's) also replaces that row's version rather than adding a twin.
 - **file upload** — one file from the user's computer (≤ 25 MB, `413 ETOOBIG`), snapshotted under its own base name (no folder kept).
 - **skill upload / new** — a skill made from files rather than picked: one Markdown/text file of any name becomes `SKILL.md`; several files or a picked/dropped folder (`paths` keeps the layout) need a `SKILL.md` (at the top or in one folder, which is stripped — `400 ENOSKILLMD` otherwise); a single `.zip`/`.skill` is unpacked (sizes checked from its directory first, a symlink entry `ESYMLINK`, `__MACOSX`/`.DS_Store`/`.git`/`node_modules` skipped); an upload holding several skill folders makes one artifact per skill, named by its folder, and stores NOTHING if any of them fails. The `name` the user typed (only for a single skill; else the frontmatter `name:`, the folder or the file name) is made a folder name (`skillSlug`: marks dropped, other characters → `-`; `400 EBADNAME` if nothing is left) and written into `SKILL.md`'s frontmatter as `name:`; a `description` given replaces the frontmatter's, and a skill with none anywhere is `400 ENODESCRIPTION`. Paths are relative with no `..` (`EBADPATH`); the same limits and `ESECRET` as a picked skill. `new` writes `SKILL.md` from `content` the same way.
 - **plugin** — only the spec and its marketplace source (`EBADPLUGIN`, `EBADMARKET`: `owner/repo`, a `validateRemoteUrl` URL, or an https link to a `marketplace.json`); no files. A GitHub web link becomes `owner/repo`, and a forge's `…/src/…`, `…/tree/…`, `…/blob/…` suffix or trailing slash is trimmed. The same `key` added again by its owner updates that row. **inspect** reads the marketplace's `.claude-plugin/marketplace.json` to list its plugins: a git link is cloned shallow, blob-less and without checkout into a temp dir that is removed after, with every credential helper switched off and no prompt (a repository that needs a login is `502 ENEEDLOGIN`; type the key by hand — installing then uses each user's own git login), https only (an ssh link is `400 ESSHMARKET`); a repo with only a `plugin.json` is `400 ENOTMARKET`; unreachable `502 EMARKETFETCH`. It reaches any https host a signed-in user names, like `publish` does — no login is ever sent with it.
@@ -372,7 +372,13 @@ Wherever the dashboard names a person — the sidebar's sign-out tooltip, the
 workspace list's owner groups, the Users page and its audit log, the Edit user
 form — it shows their display name when one is set, else the username (the
 Users page keeps `@username` beside a display name). Logging in, the CLI and
-the Linux account always use the username.
+the Linux account always use the username. No one can pose as a colleague: a
+display name that reads as another account's display name or username — marks,
+case, spaces, punctuation, a bracketed part like "(you)" and look-alike letters
+from other alphabets ignored — is refused (`409 ENAMETAKEN`), whether the user
+sets it in Settings → Account or an admin does on the Users page. A name an
+account already has is kept on an unrelated save; rename an old clash from the
+Users page.

 Under S3 an admin's folder browser opens on their own home too; ticking
 **Server folder** opens the host account's home (`/home/<host>`), where a
@@ -726,7 +732,17 @@ An admin limits what each user may spend, in dollars, on the Users page
  every account change; each one re-applies at once (`sweep`).

 Spend is the users page's own figure: the tokens of the sessions the user
-OWNS through a workspace, priced by `calculateCost`. The Users table shows
+OWNS, priced by `calculateCost`. A session is owned through its workspace;
+one no workspace owns — a script's `claude -p` in a temp folder, a CLI in a
+plain terminal — is owned by the user of the Linux account it ran as
+(`sessions.account`, `server/lib/session-account.js`: the hook's peer uid,
+else the session's folder): a member's account bills to that member, the
+host's to the admin ticked **Owns this server's host account** in Edit user
+(`PATCH /api/users/:id` `{hostAccount: true}`, at most one), or with none
+ticked to the only admin. The same rule feeds the status bar's **Today**.
+A process that drops the pane's environment also drops
+`AGENTHUB_QUOTA_FILE`, so its prompts are not refused by the hook — but its
+spend still counts, and stops the user's next session. The Users table shows
 each user's spend against their quota; the user sees their own as **Quota N%**
 in the status bar (`GET /api/me/quota`).

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
  title: Agent Dashboard for Claude Code API
-  version: 2.8.30
+  version: 2.8.40
  description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
  contact:
    name: Nguyễn Ngọc Trí Vĩ
@@ -15410,6 +15410,9 @@ paths:
                  type: boolean
                  enum:
                    - true
+                hostAccount:
+                  type: boolean
+                  description: 'An admin owns the host''s Linux account: its sessions outside every workspace are billed to them (at most one; EBADROLE for a non-admin)'
                quota:
                  $ref: '#/components/schemas/UserQuotaSetting'
                currentPassword:
@@ -19932,6 +19935,9 @@ paths:
                    items:
                      type: string
                    description: Files the switch wrote.
+                  following:
+                    type: boolean
+                    description: 'Codex: a running app-server daemon was restarted, so open and new sessions use the new login.'
        '400':
          description: '`EBADNAME` / `EBADLABEL`.'
          content:
@@ -1,12 +1,12 @@
 {
  "name": "agenthub",
-  "version": "2.8.38",
+  "version": "2.8.45",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "agenthub",
-      "version": "2.8.38",
+      "version": "2.8.45",
      "hasInstallScript": true,
      "license": "UNLICENSED",
      "dependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "agenthub",
-  "version": "2.8.38",
+  "version": "2.8.45",
  "bin": {
    "agenthub": "bin/agenthub.js"
  },
@@ -665,6 +665,105 @@ describe("skills from files or written", () => {
    assert.equal(bad.body.error.code, "EBADNAME");
  });

+  it("updates the uploader's same-named skill instead of adding a twin", async () => {
+    const md = (v) => `---\nname: sg-again\ndescription: version ${v}\n---\nBody ${v}.\n`;
+    const first = await upload("/api/artifacts/skill/upload", [["sg-again/SKILL.md", md(1)]]);
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const id = first.body.items[0].id;
+    const again = await upload("/api/artifacts/skill/upload", [["sg-again/SKILL.md", md(2)]]);
+    assert.equal(again.status, 201, JSON.stringify(again.body));
+    assert.equal(again.body.items[0].id, id);
+    assert.equal(again.body.items[0].replaced, true);
+    assert.equal(again.body.items[0].changed, true);
+    assert.equal(again.body.items[0].description, "version 2");
+    assert.match(snapText(again.body.items[0]), /Body 2\./);
+    const rows = db
+      .prepare("SELECT COUNT(*) AS n FROM artifacts WHERE kind = 'skill' AND source = 'sg-again'")
+      .get();
+    assert.equal(rows.n, 1);
+    const same = await upload("/api/artifacts/skill/upload", [["sg-again/SKILL.md", md(2)]]);
+    assert.equal(same.body.items[0].changed, false);
+  });
+
+  it("Share again: an uploaded skill asks for its folder, which replaces that row", async () => {
+    const md = (v) => `---\nname: sg-up\ndescription: d\n---\nUp ${v}.\n`;
+    const first = await upload("/api/artifacts/skill/upload", [["sg-up/SKILL.md", md(1)]]);
+    const id = first.body.items[0].id;
+    const no = await request("POST", `/api/artifacts/${id}/reshare`);
+    assert.equal(no.status, 409);
+    assert.equal(no.body.error.code, "ENOSOURCE");
+    // The folder picked again, under any folder name: onto THIS row.
+    const r = await upload("/api/artifacts/skill/upload", [["renamed/SKILL.md", md(2)]], {
+      id: String(id),
+    });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.items[0].id, id);
+    assert.equal(r.body.items[0].source, "sg-up");
+    assert.match(snapText(r.body.items[0]), /^---\nname: sg-up\n[\s\S]*Up 2\./);
+    const two = await upload(
+      "/api/artifacts/skill/upload",
+      [
+        ["p/a/SKILL.md", "---\nname: a\ndescription: d\n---\n"],
+        ["p/b/SKILL.md", "---\nname: b\ndescription: d\n---\n"],
+      ],
+      { id: String(id) }
+    );
+    assert.equal(two.body.error.code, "EBADUPLOAD");
+  });
+
+  it("Share again takes the owner's folder, else the skill of an installed plugin", async () => {
+    const home = process.env.CLAUDE_HOME;
+    // An uploaded skill whose name a user-scope plugin also ships.
+    const first = await upload("/api/artifacts/skill/upload", [
+      ["sg-plug/SKILL.md", "---\nname: sg-plug\ndescription: d\n---\nOld.\n"],
+    ]);
+    const id = first.body.items[0].id;
+    const writePlugin = (ver, text) => {
+      const at = path.join(home, "plugins", "cache", "m", "p", ver);
+      fs.mkdirSync(path.join(at, "skills", "sg-plug"), { recursive: true });
+      fs.writeFileSync(path.join(at, "skills", "sg-plug", "SKILL.md"), text);
+      return at;
+    };
+    const v1 = writePlugin("1.0.0", "---\nname: sg-plug\ndescription: d\n---\nPlugin one.\n");
+    const v2 = writePlugin("2.0.0", "---\nname: sg-plug\ndescription: d\n---\nPlugin two.\n");
+    fs.writeFileSync(
+      path.join(home, "plugins", "installed_plugins.json"),
+      JSON.stringify({
+        version: 2,
+        plugins: {
+          "p@m": [{ scope: "user", installPath: v2, lastUpdated: "2026-10-30T00:00:00Z" }],
+          "old@m": [{ scope: "user", installPath: v1, lastUpdated: "2026-01-01T00:00:00Z" }],
+          "proj@m": [
+            { scope: "project", installPath: "/etc", lastUpdated: "2027-01-01T00:00:00Z" },
+          ],
+        },
+      })
+    );
+    const r = await request("POST", `/api/artifacts/${id}/reshare`);
+    assert.equal(r.status, 200, r.text);
+    assert.equal(r.body.changed, true);
+    assert.match(snapText(r.body.item), /Plugin two\./);
+    assert.equal((await request("POST", `/api/artifacts/${id}/reshare`)).body.changed, false);
+
+    // The owner's own ~/.claude/skills folder outranks a plugin's copy.
+    const own = path.join(home, "skills", "sg-plug");
+    fs.mkdirSync(own, { recursive: true });
+    fs.writeFileSync(
+      path.join(own, "SKILL.md"),
+      "---\nname: sg-plug\ndescription: d\n---\nMine.\n"
+    );
+    const mine = await request("POST", `/api/artifacts/${id}/reshare`);
+    assert.equal(mine.body.changed, true);
+    assert.match(snapText(mine.body.item), /Mine\./);
+    // Recorded as the folder's state: the 15 s sync does not take it twice.
+    assert.deepEqual(
+      artifacts.syncSkillSources({ force: true }).filter((c) => c.id === id),
+      []
+    );
+    fs.rmSync(path.join(home, "plugins"), { recursive: true, force: true });
+    fs.rmSync(own, { recursive: true, force: true });
+  });
+
  it("keeps an uploaded file as a snapshot, by its own base name", async () => {
    const r = await upload("/api/artifacts/file/upload", [["report.html", "<h1>x</h1>"]], {
      title: "Report",
@@ -473,6 +473,55 @@ describe("reads larger than the git() buffer report truncated, not missing", ()
  });
 });

+describe("a page with megabyte-long lines (inlined base64) keeps every hunk", () => {
+  const blob = (c) => c.repeat(3 * 1024 * 1024); // one 3 MB line
+
+  it("cuts the long rows down and still shows the hunks after them", async () => {
+    const body = (mid, end) =>
+      [
+        "<h1>title</h1>",
+        ...Array.from({ length: 40 }, (_, i) => `row ${i}`),
+        mid,
+        ...Array.from({ length: 40 }, (_, i) => `tail ${i}`),
+        end,
+        "",
+      ].join("\n");
+    write(LANE, "deck.html", body(`<video src="${blob("A")}">`, "<p>old end</p>"));
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "deck");
+    write(
+      LANE,
+      "deck.html",
+      body(`<video src="${blob("B")}">`, "<p>new end</p>").replace(
+        "<h1>title</h1>",
+        "<h1>new title</h1>"
+      )
+    );
+    const out = await collectChanges(LANE, { range: "work", file: "deck.html" });
+    const f = out.files[0];
+    assert.equal(f.truncated, undefined);
+    assert.equal(out.truncated, false);
+    const lines = f.hunks.flatMap((h) => h.lines);
+    const long = lines.filter((l) => l.elided);
+    assert.equal(long.length, 2);
+    for (const l of long) {
+      assert.ok(l.text.length < 2000);
+      assert.equal(l.text.length + l.elided, '<video src="'.length + 3 * 1024 * 1024 + 2);
+    }
+    // The change AFTER the 3 MB rows survives: the cap no longer eats it.
+    assert.ok(lines.some((l) => l.type === "add" && l.text === "<p>new end</p>"));
+    assert.ok(lines.some((l) => l.type === "add" && l.text === "<h1>new title</h1>"));
+  });
+
+  it("leaves ordinary rows whole", async () => {
+    write(LANE, "a.txt", "one\nTWO\n");
+    const out = await collectChanges(LANE, { range: "work", file: "a.txt" });
+    const lines = out.files[0].hunks.flatMap((h) => h.lines);
+    assert.ok(lines.every((l) => l.elided === undefined));
+    assert.ok(lines.some((l) => l.text === "TWO"));
+  });
+});
+
 describe("loop 2: secret file at any depth, symlinked .claude", () => {
  const KEY = '{"env":{"ANTHROPIC_API_KEY":"sk-deep"}}';

@@ -203,18 +203,21 @@ describe("collectChanges — work range", () => {
    });
  });

-  it("still returns content when a huge file has no newline to cut on", async () => {
-    // A minified bundle is ONE line. Cutting the patch at the last newline
-    // inside the cap would land at index -1 here and hand back an empty
-    // patch — a file changed by a megabyte rendering as "no textual change".
+  it("still returns content when a huge file is one line", async () => {
+    // A minified bundle is ONE line. It used to be cut at the per-file cap
+    // (and, cut at the last newline, could come back empty — a file changed
+    // by a megabyte rendering as "no textual change"); now the row itself is
+    // cut down and says how much it hides, and nothing is truncated.
    const { MAX_FILE_BYTES } = require("../lib/git-diff");
    write(LANE, "min.js", `${"x".repeat(MAX_FILE_BYTES + 5000)}\n`);
    const out = await collectChanges(LANE, { range: "work", file: "min.js" });
    const entry = out.files[0];
-    assert.equal(entry.truncated, true);
-    assert.equal(out.truncated, true);
-    assert.ok(entry.hunks.length > 0, "a truncated patch still carries its hunk");
-    assert.ok(entry.hunks[0].lines[0].text.startsWith("xxx"));
+    assert.equal(entry.truncated, undefined);
+    assert.equal(out.truncated, false);
+    assert.ok(entry.hunks.length > 0, "the patch still carries its hunk");
+    const row = entry.hunks[0].lines.find((l) => l.type === "add");
+    assert.ok(row.text.startsWith("xxx"));
+    assert.equal(row.text.length + row.elided, MAX_FILE_BYTES + 5000);
  });

  it("reports a binary file without trying to diff it", async () => {
@@ -848,6 +851,51 @@ describe("runGitAction — one change block inside a hunk (issue #50)", () => {
    assert.equal(fs.readFileSync(path.join(LANE, "tail.txt"), "utf8"), "l1\nl2\nl3\nl4\nl5\nl6");
  });

+  it("discards only the ticked blocks and whole files, nothing unticked (issue #87)", async () => {
+    const edited = threeBlocks();
+    write(LANE, "keep.txt", "untouched by discard\n");
+    write(LANE, "drop.txt", "gone\n");
+    const [hunk] = await hunkOf();
+    await assert.rejects(
+      () =>
+        runGitAction(LANE, "discard", {
+          paths: ["drop.txt"],
+          hunks: { "near.txt": [{ hunk: hunk.header, blocks: [0, 2] }] },
+        }),
+      { code: "ECONFIRM" }
+    );
+    await runGitAction(LANE, "discard", {
+      paths: ["drop.txt"],
+      hunks: { "near.txt": [{ hunk: hunk.header, blocks: [0, 2] }] },
+      confirm: true,
+    });
+    const want = [...edited];
+    want.splice(11, 0, "line 11");
+    want.splice(3, 2, "line 4", "line 5");
+    assert.deepEqual(read(), [...want, ""]);
+    assert.equal(fs.existsSync(path.join(LANE, "drop.txt")), false);
+    assert.equal(fs.readFileSync(path.join(LANE, "keep.txt"), "utf8"), "untouched by discard\n");
+  });
+
+  it("discards ticked blocks alone, and refuses a stale one with nothing undone", async () => {
+    const edited = threeBlocks();
+    const [hunk] = await hunkOf();
+    await assert.rejects(
+      () =>
+        runGitAction(LANE, "discard", {
+          hunks: { "near.txt": [{ hunk: "@@ -1,2 +1,2 @@", blocks: [0] }] },
+          confirm: true,
+        }),
+      { code: "EHUNKGONE" }
+    );
+    assert.deepEqual(read(), [...edited, ""]);
+    await runGitAction(LANE, "discard", {
+      hunks: { "near.txt": [{ hunk: hunk.header, blocks: [1] }] },
+      confirm: true,
+    });
+    assert.deepEqual(read(), [...edited.filter((l) => l !== "INSERTED"), ""]);
+  });
+
  it("refuses a block the hunk does not have", async () => {
    threeBlocks();
    const [hunk] = await hunkOf();
@@ -222,6 +222,26 @@ describe("Settings → Account (/api/me)", () => {
    assert.equal(bad.body.error.code, "EBADEMAIL");
  });

+  it("refuses a display name that reads as another account's (ENAMETAKEN)", async () => {
+    assert.equal(auth.nameKey("Nguyễn Ngọc Trí Vĩ (you)"), auth.nameKey("nguyen.ngoc-tri VI"));
+    assert.equal(auth.nameKey("Đào"), "dao");
+    // Cyrillic о and а in place of Latin letters.
+    assert.equal(auth.nameKey("Mіа Trоn"), auth.nameKey("Mia Tron"));
+    const leo = await login("leo", "member-pass-2");
+    // mia's display name is "Mia Tran"; boss has none, only a username.
+    for (const name of ["MIA TRẦN (you)", "Mia\u200b Tran", "mia", "Bóss"]) {
+      const r = await call("PATCH", "/api/me/account", { cookie: leo, body: { displayName: name } });
+      assert.equal(r.status, 409, name);
+      assert.equal(r.body.error.code, "ENAMETAKEN");
+    }
+    assert.equal(auth.findUser("leo").display_name, "Leo N");
+    // Keeping one's own name, or a name of one's own, still works.
+    for (const name of ["Leo N", "Leo Nguyen"]) {
+      const r = await call("PATCH", "/api/me/account", { cookie: leo, body: { displayName: name } });
+      assert.equal(r.status, 200, name);
+    }
+  });
+
  it("changes its own password only with the old one, keeping this login", async () => {
    const leo = await login("leo", "member-pass-2");
    const other = await login("leo", "member-pass-2");
@@ -0,0 +1,110 @@
+/**
+ * @file session-account.test.js
+ * @description A session no workspace owns is billed to the user of the Linux
+ * account it ran as (server/lib/session-account.js): a member's account to
+ * that member, the host's to the admin marked as its owner (or the only
+ * admin). A workspace's ownership always wins, a pushed session never gets an
+ * account, and the hook peer is stamped once.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const fs = require("node:fs");
+const os = require("node:os");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "session-account-test-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+
+const { db } = require("../db");
+const sa = require("../lib/session-account");
+const scope = require("../lib/scope");
+const { OWNED_SESSIONS } = require("../routes/users");
+
+const own = (id) => {
+  const w = scope.ownSessionWhere({ user: { id } });
+  return db
+    .prepare(`SELECT id FROM sessions WHERE ${w.where} ORDER BY id`)
+    .all(...w.params)
+    .map((r) => r.id);
+};
+
+before(() => {
+  const user = db.prepare(
+    "INSERT INTO users (id, username, role, password_hash) VALUES (?, ?, ?, 'x')"
+  );
+  user.run(1, "boss", "admin");
+  user.run(2, "dev", "developer");
+  db.prepare("INSERT INTO lanes (id, cwd, tool, owner_id) VALUES (1, '/w/dev', 'claude', 2)").run();
+  const s = db.prepare(
+    "INSERT INTO sessions (id, name, status, cwd, lane_id, account, source) VALUES (?, ?, 'active', '/w', ?, ?, ?)"
+  );
+  s.run("host-free", "eval", null, "", "local");
+  s.run("dev-free", "eval", null, "dev", "local");
+  s.run("host-in-dev-lane", "lane", 1, "", "local");
+  s.run("unknown", "old", null, null, "local");
+  s.run("gone-member", "x", null, "ghost", "local");
+});
+
+after(() => fs.rmSync(TMP, { recursive: true, force: true }));
+
+describe("session-account", () => {
+  it("bills a member's account to that member and the host's to the only admin", () => {
+    assert.equal(sa.hostOwner(), 1);
+    assert.deepEqual(own(1), ["host-free"]);
+    assert.deepEqual(own(2), ["dev-free", "host-in-dev-lane"]);
+  });
+
+  it("lets the workspace's owner win over the account", () => {
+    assert.ok(!own(1).includes("host-in-dev-lane"));
+  });
+
+  it("bills nobody for the host when two admins and none is marked, then the marked one", () => {
+    db.prepare(
+      "INSERT INTO users (id, username, role, password_hash) VALUES (3, 'boss2', 'admin', 'x')"
+    ).run();
+    assert.equal(sa.hostOwner(), null);
+    assert.deepEqual(own(1), []);
+    sa.setHostOwner(3);
+    assert.equal(sa.hostOwner(), 3);
+    assert.deepEqual(own(3), ["host-free"]);
+    sa.setHostOwner(1);
+    assert.deepEqual(own(3), []);
+    assert.deepEqual(own(1), ["host-free"]);
+  });
+
+  it("lists account-billed sessions in OWNED_SESSIONS (Users page, spend quota)", () => {
+    const rows = db.prepare(OWNED_SESSIONS).all();
+    const by = Object.fromEntries(rows.map((r) => [r.session_id, r.uid]));
+    assert.equal(by["host-free"], 1);
+    assert.equal(by["dev-free"], 2);
+    assert.equal(by["host-in-dev-lane"], 2);
+    assert.equal(by.unknown, undefined);
+    assert.equal(by["gone-member"], undefined);
+  });
+
+  it("stamps the hook peer once and never a pushed session", () => {
+    db.prepare("INSERT INTO sessions (id, name, status, cwd) VALUES ('fresh', 'f', 'active', '/w')").run();
+    db.prepare("INSERT INTO sessions (id, name, status, cwd) VALUES ('pushed', 'p', 'active', '/w')").run();
+    sa.stampFromPeer("fresh", { kind: "member", name: "dev", home: "/srv/u/dev" });
+    sa.stampFromPeer("fresh", { kind: "host" });
+    sa.stampFromPeer("pushed", { kind: "host" }, "push:laptop");
+    sa.stampFromPeer("pushed", { kind: "refused" });
+    const acct = (id) => db.prepare("SELECT account FROM sessions WHERE id = ?").get(id).account;
+    assert.equal(acct("fresh"), "dev");
+    assert.equal(acct("pushed"), null);
+  });
+
+  it("gives a folder's account to sessions no hook stamped, skipping pushed ones", () => {
+    db.prepare(
+      "INSERT INTO sessions (id, name, status, cwd, source) VALUES ('remote', 'r', 'active', '/w', 'push:laptop')"
+    ).run();
+    sa.stampFromFolders();
+    const acct = (id) => db.prepare("SELECT account FROM sessions WHERE id = ?").get(id).account;
+    // Outside S3 every folder is the host's.
+    assert.equal(acct("unknown"), "");
+    assert.equal(acct("pushed"), "");
+    assert.equal(acct("remote"), null);
+  });
+});
@@ -97,6 +97,33 @@ describe("tool-profiles: codex", () => {
    );
  });

+  it("restarts a running Codex daemon so open sessions follow; none running, nothing to restart", async () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-b", "bob@example.com");
+    profiles.saveProfile("codex");
+    assert.equal(profiles.activateProfile("codex", "alice").following, false);
+
+    const log = path.join(ROOT, "codex-argv.log");
+    const bin = path.join(ROOT, "fake-codex.sh");
+    fs.writeFileSync(bin, `#!/bin/sh\necho "$CODEX_HOME $*" >> '${log}'\n`, { mode: 0o755 });
+    const sock = path.join(process.env.CODEX_HOME, "app-server-control", "app-server-control.sock");
+    fs.mkdirSync(path.dirname(sock), { recursive: true });
+    fs.writeFileSync(sock, "");
+    process.env.AGENTHUB_CODEX_BIN = bin;
+    try {
+      assert.equal(profiles.activateProfile("codex", "bob").following, true);
+      for (let i = 0; i < 50 && !fs.existsSync(log); i++)
+        await new Promise((r) => setTimeout(r, 20));
+      assert.equal(
+        fs.readFileSync(log, "utf8").trim(),
+        `${process.env.CODEX_HOME} app-server daemon restart`
+      );
+    } finally {
+      delete process.env.AGENTHUB_CODEX_BIN;
+    }
+  });
+
  it("refuses to switch away from an unsaved login", () => {
    login("acct-a", "alice@example.com");
    profiles.saveProfile("codex");
@@ -93,6 +93,12 @@ describe("GET /api/sessions/:id/stats tool totals", () => {
    assert.equal(body.tool_call_count, 2);
    assert.equal(body.distinct_tool_count, 1);
  });
+  it("counts each call once in tools_used, not its Pre and Post events", async () => {
+    const one = (await get("/api/sessions/ua-1/stats")).body.tools_used;
+    assert.ok(one.every((t) => t.count === 1));
+    const two = (await get("/api/sessions/ua-2/stats")).body.tools_used;
+    assert.deepEqual(two, [{ tool_name: "Read", count: 2 }]);
+  });
 });

 describe("GET /api/events labels", () => {
@@ -1445,6 +1445,16 @@ try {
  db.prepare("ALTER TABLE sessions ADD COLUMN pinned_at TEXT").run();
 }

+// Migrate: add `account` to sessions — the Linux account a session ran as
+// (server/lib/session-account.js): "" = the host's, else the S3 member's name;
+// NULL = not known yet. A session no workspace owns is billed to the user of
+// that account (server/lib/scope.js), so a script's `claude -p` still counts.
+try {
+  db.prepare("SELECT account FROM sessions LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE sessions ADD COLUMN account TEXT").run();
+}
+
 // How far each Codex rollout journal has been read (server/lib/codex-usage.js).
 // In the DB, not a side file, so a session the user deleted stays deleted
 // until Codex writes to its journal again, while a wiped DB re-imports all.
@@ -1952,6 +1962,9 @@ for (const col of ["display_name", "email", "avatar_at", "avatar_link"]) {
 for (const [col, type] of [
  ["last_login_at", "TEXT"],
  ["must_change_password", "INTEGER NOT NULL DEFAULT 0"],
+  // The admin who owns the HOST's Linux account: its sessions outside every
+  // workspace are billed to them (server/lib/session-account.js). At most one.
+  ["host_account", "INTEGER NOT NULL DEFAULT 0"],
 ]) {
  try {
    db.prepare(`SELECT ${col} FROM users LIMIT 1`).get();
@@ -2547,10 +2560,16 @@ const stmts = {
    FROM events
    WHERE session_id = ? AND tool_name IS NOT NULL
  `),
+  // One row per call, like sessionToolCallTotals: a call is its PreToolUse,
+  // or its PostToolUse in a session that has none (imported). Counting every
+  // event with a tool_name counted each call twice.
  sessionToolUsageCounts: db.prepare(`
    SELECT tool_name, COUNT(*) as count
    FROM events
    WHERE session_id = ? AND tool_name IS NOT NULL
+      AND event_type = CASE
+        WHEN EXISTS (SELECT 1 FROM events WHERE session_id = ? AND event_type = 'PreToolUse')
+        THEN 'PreToolUse' ELSE 'PostToolUse' END
    GROUP BY tool_name
    ORDER BY count DESC
    LIMIT 15
@@ -873,7 +873,9 @@ function startBackgroundServices() {
    if (poolTimer.unref) poolTimer.unref();
  }
  // Server mode's spend quotas (user-quota.js): who is over theirs now, the
-  // flag files their hooks read, the panes no hook can stop. Off with
+  // flag files their hooks read, the panes no hook can stop — after giving
+  // the sessions no hook made their Linux account (session-account.js), so a
+  // poller's session is billed to someone too. Off with
  // DASHBOARD_QUOTA_SWEEP_MS=0; a no-op in local mode.
  const QUOTA_SWEEP_MS = Number(process.env.DASHBOARD_QUOTA_SWEEP_MS ?? 60_000);
  if (
@@ -883,6 +885,7 @@ function startBackgroundServices() {
  ) {
    const quotaSweep = () => {
      try {
+        require("./lib/session-account").stampFromFolders();
        require("./lib/user-quota").sweep();
      } catch (err) {
        console.warn("user quota sweep failed:", err.message);
@@ -1125,8 +1125,20 @@ function saveSkillFiles(req, { name, files, title, description }) {
 * `paths`). Answers every skill it made. Nothing is stored unless every
 * skill in the upload passes.
 */
-function uploadSkills(req, { uploads, name, title, description }) {
+function uploadSkills(req, { uploads, name, title, description, id }) {
+  // `id`: Share again for a skill the server has no copy of — the upload
+  // replaces THAT row (one skill, named as the row is).
+  let onto = null;
+  if (id != null && id !== "") {
+    onto = load(req, id);
+    if (!canChange(req, onto)) throw fail("EFORBIDDEN", "only its owner changes an artifact");
+    if (onto.kind !== "skill") throw fail("EBADKIND", "only a skill is shared again");
+    name = onto.source;
+  }
  const found = skillsFromUpload(uploads || [], { name, description });
+  if (onto && found.length !== 1) {
+    throw fail("EBADUPLOAD", "choose the folder or .zip of this one skill");
+  }
  const typed = typeof name === "string" && name.trim();
  const prepared = found.map((sk) => ({
    name: validSkillName(found.length === 1 && typed ? typed : sk.fallbackName || ""),
@@ -1140,16 +1152,46 @@ function uploadSkills(req, { uploads, name, title, description }) {
    withFrontmatter(md.data.toString("utf8"), p.name, found.length === 1 ? description : "");
    checkSkillFiles(p.files);
  }
-  return prepared.map((p) =>
-    saveSkillFiles(req, {
+  return prepared.map((p) => {
+    // A skill its uploader already has (same name, not a workspace's) gets
+    // the new version on that row — installers see Update — never a twin.
+    const own = onto || ownSkillRow(req, p.name);
+    if (own) return replaceUploaded(req, own, p, found.length === 1 ? description : "");
+    return saveSkillFiles(req, {
      name: p.name,
      files: p.files,
      title: found.length === 1 ? title : "",
      description: found.length === 1 ? description : "",
-    })
+    });
+  });
+}
+
+/** The caller's newest skill row of that name taken from no workspace, or null. */
+function ownSkillRow(req, name) {
+  const owner = req?.user ? req.user.id : null;
+  return (
+    sql(
+      `SELECT * FROM artifacts WHERE kind = 'skill' AND source = ? AND lane_id IS NULL
+         AND snapshot IS NOT NULL AND owner_id IS ? ORDER BY updated_at DESC, id DESC LIMIT 1`
+    ).get(name, owner) || null
  );
 }

+/** An uploaded skill onto an existing row: same frontmatter rules as a new one. */
+function replaceUploaded(req, row, { name, files }, description) {
+  const md = files.find((f) => f.path === "SKILL.md");
+  const text = md.data.toString("utf8");
+  if (text.includes("\uFFFD")) throw fail("EBADSKILL", "SKILL.md is not a UTF-8 text file");
+  const fixed = Buffer.from(withFrontmatter(text, name, description), "utf8");
+  const all = [{ path: "SKILL.md", data: fixed }, ...files.filter((f) => f !== md)];
+  checkSkillFiles(all);
+  const changed = contentHash(all) !== snapshotVersion(row);
+  // The owner's folder as it is now (like `storeSkill`): only a LATER change
+  // to it replaces this upload.
+  if (changed) replaceSnapshot(row, all, sourceHash(row) ?? row.source_hash);
+  return { ...shareNow(req, row.id, changed), replaced: true, changed };
+}
+
 /** A skill written in the dialog: a name, a description and its instructions. */
 function writeSkill(req, { name, description, content, title }) {
  const n = validSkillName(name);
@@ -1936,6 +1978,23 @@ function syncOne(row) {
  } catch {
    return false;
  }
+  try {
+    replaceSnapshot(row, files, st.hash);
+  } catch {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Point a skill row at a NEW snapshot holding `files` (`[{path, data}]`, already
+ * checked), then drop the old one — never a write into the snapshot being
+ * read. Installers then see Update (`updateCheck`). `sourceHash` is the
+ * source folder's state to record, so `syncOne` takes only a LATER change.
+ * The description follows SKILL.md's only while it still says what the old
+ * one did.
+ */
+function replaceSnapshot(row, files, sourceHash) {
  const snap = newSnapshotDir();
  let total = 0;
  const next = [];
@@ -1947,11 +2006,10 @@ function syncOne(row) {
      total += f.data.length;
      next.push({ path: f.path, size: f.data.length });
    }
-  } catch {
+  } catch (err) {
    dropSnapshot(snap.id);
-    return false;
+    throw err;
  }
-  // The description follows SKILL.md's only while it still says what the old one did.
  const md = (list) => list.find((f) => f.path === "SKILL.md");
  let oldSummary = "";
  try {
@@ -1970,9 +2028,96 @@ function syncOne(row) {
  sql(
    `UPDATE artifacts SET snapshot = ?, files = ?, size = ?, version = ?, source_hash = ?,
            description = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
-  ).run(snap.id, JSON.stringify(next), total, st.hash, st.hash, description, row.id);
+  ).run(
+    snap.id,
+    JSON.stringify(next),
+    total,
+    contentHash(files),
+    sourceHash ?? null,
+    description,
+    row.id
+  );
  if (row.snapshot && SNAPSHOT_RE.test(row.snapshot)) dropSnapshot(row.snapshot);
-  return true;
+}
+
+/**
+ * The owner's skill folder on THIS server as it is now, for Share again:
+ * the row's own source folder (`sourceDirOf`), else — a skill not taken from
+ * a workspace — the same-named skill of a plugin the owner installed at user
+ * scope (`installed_plugins.json`; the most recently updated when several
+ * have it), never outside the owner's `~/.claude/plugins/`. Answers
+ * `{st, fromSource}` (`folderState`) or null when the server has no copy (an
+ * uploaded skill: its owner picks the folder again).
+ */
+function machineSkill(row) {
+  const src = sourceDirOf(row);
+  const st = src && folderState(src.dir, src.top);
+  if (st) return { st, fromSource: true };
+  if (!src || row.lane_id != null) return null;
+  const top = path.join(src.top, "plugins");
+  let installed = {};
+  try {
+    const user = sql("SELECT id, username, role FROM users WHERE id = ?").get(row.owner_id);
+    const file = path.join(top, "installed_plugins.json");
+    const text =
+      user && ownAccount({ user }).acct
+        ? require("./run-as").readFileSafe(file, "utf8", { max: 4 << 20 })
+        : fs.readFileSync(file, "utf8");
+    installed = JSON.parse(text)?.plugins || {};
+  } catch {
+    return null;
+  }
+  let best = null;
+  for (const entries of Object.values(installed)) {
+    for (const e of Array.isArray(entries) ? entries : []) {
+      if (!e || e.scope !== "user" || typeof e.installPath !== "string") continue;
+      const st2 = folderState(path.join(e.installPath, "skills", row.source), top);
+      const at = Date.parse(e.lastUpdated || e.installedAt || "") || 0;
+      if (st2 && (!best || at > best.at)) best = { st: st2, at };
+    }
+  }
+  return best ? { st: best.st, fromSource: false } : null;
+}
+
+/**
+ * Share again: take the owner's skill folder on this server as the row's new
+ * snapshot (`machineSkill`) and share it (server mode), so installers are
+ * offered Update. ENOSOURCE when the server has no copy — the client then
+ * asks for the folder or .zip and uploads it onto this row (`uploadSkills`
+ * with `id`). Answers `{item, changed}`.
+ */
+function reshareSkill(req, id) {
+  const row = load(req, id);
+  if (!canChange(req, row)) throw fail("EFORBIDDEN", "only its owner changes an artifact");
+  if (row.kind !== "skill") throw fail("EBADKIND", "only a skill is shared again");
+  const found = machineSkill(row);
+  if (!found) {
+    throw fail("ENOSOURCE", "this server has no copy of the skill: choose its folder or .zip");
+  }
+  const files = found.st.read();
+  checkSkillFiles(files);
+  const changed = found.st.hash !== snapshotVersion(row);
+  if (changed) {
+    replaceSnapshot(row, files, found.fromSource ? found.st.hash : row.source_hash);
+  } else if (found.fromSource) {
+    sql("UPDATE artifacts SET source_hash = ? WHERE id = ?").run(found.st.hash, row.id);
+  }
+  return { item: shareNow(req, row.id, changed), changed };
+}
+
+/** Share a row (server mode, when it is not yet) and answer its view; `audit` names a new version. */
+function shareNow(req, id, changed) {
+  const row = sql("SELECT * FROM artifacts WHERE id = ?").get(id);
+  if (isServer() && row.shared !== 1) {
+    sql(
+      `UPDATE artifacts SET shared = 1, shared_at = strftime('%Y-%m-%dT%H:%M:%fZ','now'),
+              updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
+    ).run(id);
+    audit(req, row, "shared");
+  } else if (changed && row.shared === 1) {
+    audit(req, row, "updated");
+  }
+  return view(sql("SELECT * FROM artifacts WHERE id = ?").get(id), req);
 }

 const SYNC_EVERY_MS = 15 * 1000;
@@ -2215,6 +2360,7 @@ module.exports = {
  availableSkills,
  addSkill,
  uploadSkills,
+  reshareSkill,
  writeSkill,
  uploadFile,
  skillSlug,
@@ -20,7 +20,8 @@
 *   admin on the Users page (`server/routes/users.js`), where every change
 *   needs the admin's own password again (`confirmPassword`, throttled).
 *   An account also carries an optional display name and email
- *   (`validateProfile`), which its owner edits in Settings → Account without
+ *   (`validateProfile`; no two accounts may read as one name — `assertNameFree`,
+ *   ENAMETAKEN), which its owner edits in Settings → Account without
 *   that step-up; changing their OWN password there needs the old one and
 *   keeps the login it was changed from (`setPassword`'s `keepToken`).
 * - Two password bars: an admin may GIVE any non-empty password (a create or a
@@ -212,6 +213,9 @@ const publicUser = (u) =>
    createdAt: u.created_at ?? null,
    // An admin gave this password: the account must pick its own first.
    mustChangePassword: Boolean(u.must_change_password),
+    // Owns the host's Linux account: its sessions outside every workspace
+    // are billed to this admin (server/lib/session-account.js).
+    hostAccount: Boolean(u.host_account),
  };

 const MAX_DISPLAY_NAME = 100;
@@ -247,6 +251,47 @@ function validateProfile(body) {
  return out;
 }

+// Latin look-alikes from other scripts, so "Vĩ" in Cyrillic still collides.
+const CONFUSABLE = {
+  а: "a", в: "b", е: "e", к: "k", м: "m", н: "h", о: "o", р: "p", с: "c", т: "t",
+  у: "y", х: "x", і: "i", ј: "j", ԁ: "d", ѕ: "s", ӏ: "l", α: "a", β: "b", ε: "e",
+  η: "n", ι: "i", κ: "k", ν: "v", ο: "o", ρ: "p", τ: "t", υ: "u", χ: "x", "ı": "i",
+};
+
+/**
+ * The name two accounts may not share: no marks (Vĩ = Vi), đ = d, any case,
+ * look-alike letters folded, and only letters and digits outside brackets —
+ * so "Nguyễn Ngọc Trí Vĩ (you)" and "nguyen.ngoc-tri vi" are both one name.
+ */
+function nameKey(s) {
+  return String(s || "")
+    .normalize("NFKD")
+    .replace(/\p{M}/gu, "")
+    .toLowerCase()
+    .replace(/\([^)]*\)|\[[^\]]*\]/g, "")
+    .replace(/[đð]/g, "d")
+    .replace(/./gu, (c) => CONFUSABLE[c] ?? c)
+    .replace(/[^\p{L}\p{N}]/gu, "");
+}
+
+/**
+ * Refuse (ENAMETAKEN) a display name that reads as another account's display
+ * name or username, so no one can pose as a colleague. Keeping the name one
+ * already has is always allowed — a clash from before this rule is no reason
+ * to block an admin's unrelated edit.
+ */
+function assertNameFree(userId, fields) {
+  if (!("display_name" in fields) || !fields.display_name) return;
+  const key = nameKey(fields.display_name);
+  if (!key) return;
+  const own = sql("SELECT display_name FROM users WHERE id = ?").get(userId);
+  if (own && own.display_name === fields.display_name) return;
+  const rows = sql("SELECT id, username, display_name FROM users WHERE id != ?").all(userId);
+  if (rows.some((u) => nameKey(u.username) === key || nameKey(u.display_name) === key)) {
+    throw err("ENAMETAKEN", "displayName: another account already uses that name");
+  }
+}
+
 /** Write `validateProfile`'s result for one account. */
 function setProfile(userId, fields) {
  for (const [col, value] of Object.entries(fields)) {
@@ -373,7 +418,10 @@ function setRole(username, role) {
  if (!ROLES.includes(role)) throw err("EBADROLE", `role: one of ${ROLES.join(", ")}`);
  const u = requireUser(username);
  if (role !== "admin") assertKeepsAdmin(u, "demoted");
-  sql("UPDATE users SET role = ? WHERE id = ?").run(role, u.id);
+  // Only an admin owns the host account (session-account.js): a demotion drops the mark.
+  sql(
+    "UPDATE users SET role = ?, host_account = CASE WHEN ? = 'admin' THEN host_account ELSE 0 END WHERE id = ?"
+  ).run(role, role, u.id);
  if (role !== "admin") stopHostPanes(u.id);
 }

@@ -812,6 +860,8 @@ module.exports = {
  unassignWorkspace,
  ownedWorkspaces,
  validateProfile,
+  nameKey,
+  assertNameFree,
  setProfile,
  validatePassword,
  validateOwnPassword,
@@ -61,6 +61,19 @@ async function readCapped(dir, args, capChars) {
 const MAX_FILES = 300;
 /** Most patch bytes read for ONE file before its hunks are cut short. */
 const MAX_FILE_BYTES = 200_000;
+/** Characters of one file's raw patch read before its long lines are cut down
+ *  (`elideLongLines`) and `MAX_FILE_BYTES` applied. A page that embeds a video
+ *  or a font as base64 is a few lines of megabytes each: read at
+ *  `MAX_FILE_BYTES`, its first such line used the whole budget and every hunk
+ *  after it was lost. Past this the patch is still truncated. */
+const MAX_PATCH_READ_CHARS = 16 * 1024 * 1024;
+/** A diff row longer than this is shown cut down to `LONG_LINE_KEEP`
+ *  characters, with how many it hides (`elided` on the parsed line). */
+const LONG_LINE_CHARS = 4000;
+const LONG_LINE_KEEP = 1000;
+/** Ends a cut-down row in the raw patch: a private-use character, then the
+ *  count of characters hidden. `parseUnifiedDiff` turns it into `elided`. */
+const ELIDED_MARK = "\uE000";
 /** Most patch bytes across all files in a `full` (review-mode) response. */
 const MAX_TOTAL_BYTES = 1_000_000;
 /** An untracked file larger than this is reported without content. */
@@ -259,15 +272,23 @@ function parseUnifiedDiff(patch) {
    // row of its own and carries no line number.
    if (raw.startsWith("\\")) continue;
    const marker = raw[0];
-    const text = raw.slice(1);
+    let text = raw.slice(1);
+    // A row `elideLongLines` cut down: the text it kept, and how much it hid.
+    let elided = 0;
+    const cut = text.lastIndexOf(ELIDED_MARK);
+    if (cut >= 0 && /^\d+$/.test(text.slice(cut + 1))) {
+      elided = Number(text.slice(cut + 1));
+      text = text.slice(0, cut);
+    }
+    const extra = elided ? { elided } : {};
    if (marker === "+") {
-      current.lines.push({ type: "add", oldLine: null, newLine: newLine++, text });
+      current.lines.push({ type: "add", oldLine: null, newLine: newLine++, text, ...extra });
    } else if (marker === "-") {
-      current.lines.push({ type: "del", oldLine: oldLine++, newLine: null, text });
+      current.lines.push({ type: "del", oldLine: oldLine++, newLine: null, text, ...extra });
    } else if (marker === " ") {
      // An unchanged EMPTY line is " " — one space, no text. A truly empty
      // string is the tail of the final "\n", not a row.
-      current.lines.push({ type: "ctx", oldLine: oldLine++, newLine: newLine++, text });
+      current.lines.push({ type: "ctx", oldLine: oldLine++, newLine: newLine++, text, ...extra });
    }
  }
  return hunks;
@@ -532,7 +553,27 @@ async function patchFor(dir, { range, baseRef, sha, file, untracked, context })
      : range === "branch"
        ? ["diff", u, `${baseRef}...HEAD`, "--", file]
        : ["diff", u, "HEAD", "--", file];
-  return readCapped(dir, [...args, "--no-color", "--no-ext-diff"], MAX_FILE_BYTES).catch(() => "");
+  return readCapped(dir, [...args, "--no-color", "--no-ext-diff"], MAX_PATCH_READ_CHARS).catch(
+    () => ""
+  );
+}
+
+/**
+ * The patch with every row longer than `LONG_LINE_CHARS` cut down to its first
+ * `LONG_LINE_KEEP` characters plus `ELIDED_MARK` and the count it hides. Only
+ * what the panel SHOWS is cut: the hunk actions (`hunkPatch`, `selectionPatch`)
+ * re-read git's own diff and match hunks by header, which this never changes.
+ */
+function elideLongLines(patch) {
+  if (patch.length <= LONG_LINE_CHARS) return patch;
+  return patch
+    .split("\n")
+    .map((row) =>
+      row.length > LONG_LINE_CHARS && !row.startsWith("@@")
+        ? `${row.slice(0, LONG_LINE_KEEP + 1)}${ELIDED_MARK}${row.length - LONG_LINE_KEEP - 1}`
+        : row
+    )
+    .join("\n");
 }

 /**
@@ -648,7 +689,15 @@ async function collectChanges(
        untracked: entry.untracked,
        context: ctx,
      });
+      // A read that hit its own ceiling came back partial: still cut short,
+      // however small eliding its long rows makes it.
+      const partial = patch.length >= MAX_PATCH_READ_CHARS;
+      patch = elideLongLines(patch);
      const cap = Math.min(MAX_FILE_BYTES, budget);
+      if (partial) {
+        entry.truncated = true;
+        truncated = true;
+      }
      if (patch.length > cap) {
        // Cut on a line boundary so the last row is a whole line — but only
        // when that boundary is near the cap. A minified file is one enormous
@@ -1192,16 +1241,18 @@ async function diffHunks(dir, file, context) {
 * in file order, to be applied FORWARD onto an index holding HEAD. Every
 * header is matched against a fresh diff like `hunkPatch`'s; null when one is
 * gone or names a block the hunk lacks. Each hunk's new-side start is left as
- * git wrote it — `git apply` locates a hunk by its old side.
+ * git wrote it — `git apply` locates a hunk by its old side. `reverse` cuts
+ * it for `apply -R` off the working tree instead (the partial discard, #87),
+ * where the NEW side is the one checked and every start stays git's own.
 */
-async function selectionPatch(dir, file, context, picks) {
+async function selectionPatch(dir, file, context, picks, reverse = false) {
  const diff = await diffHunks(dir, file, context);
  if (!diff || !picks.length) return null;
  const at = (header) => diff.hunks.findIndex((h) => h.slice(0, h.indexOf("\n")) === header);
  if (picks.some((p) => at(p.hunk) < 0)) return null;
  const bodies = [];
  for (const p of [...picks].sort((x, y) => at(x.hunk) - at(y.hunk))) {
-    const body = onlyBlock(diff.hunks[at(p.hunk)], p.blocks, false);
+    const body = onlyBlock(diff.hunks[at(p.hunk)], p.blocks, reverse);
    if (!body) return null;
    bodies.push(body);
  }
@@ -1334,6 +1385,7 @@ async function plainTreeAll(dir) {
 }

 module.exports = {
+  elideLongLines,
  collectChanges,
  CONFLICT_CODES,
  contentSha,
@@ -424,6 +424,13 @@ async function runGitAction(dir, action, body = {}) {

  if (action === "discard") {
    if (body.confirm !== true) throw bad("ECONFIRM", "discard requires confirm: true");
+    // Ticked change blocks of partly ticked files (#87) go first: each patch
+    // is built before any is applied, so a stale one refuses before the
+    // irreversible whole-file part below has run.
+    const partial = hasHunks(body) ? await discardSelection(dir, body) : null;
+    if (partial && !(Array.isArray(body.paths) && body.paths.length)) {
+      return done(action, partial);
+    }
    const paths = await resolvePaths(dir, body);
    const untracked = paths.filter((p) => p.code === "??").map((p) => p.path);
    // A rename's ORIGINAL path rides along: restoring only the new one would
@@ -431,7 +438,7 @@ async function runGitAction(dir, action, body = {}) {
    const tracked = paths
      .filter((p) => p.code !== "??")
      .flatMap((p) => (p.from && p.code.includes("R") ? [p.path, p.from] : [p.path]));
-    const out = [];
+    const out = partial ? [partial] : [];
    // Untracked files are deleted (git has no copy to restore); tracked ones
    // go back to HEAD in both gutters, so a staged-then-edited file lands in
    // one state rather than half-reverted.
@@ -825,18 +832,11 @@ function hasHunks(body) {
 const MAX_PARTIAL_FILES = 300;

 /**
- * JetBrains' partial commit: whole files (`paths`) plus, per file in `hunks`,
- * only the ticked change blocks — `{"<path>": [{hunk: "@@ … @@", blocks: [0]}]}`,
- * the hunks named as `stage-hunk` names them, at `context`. Built in a
- * TEMPORARY index (HEAD + the whole files + one patch per partial file from
- * `selectionPatch`, git's own fresh text, never the request's) and committed
- * from it, so the real index and the working tree are never in the way; after
- * the commit the real index entries of exactly those paths are reset to the
- * new HEAD, the rest of each partial file left as an unstaged change. Same
- * path rules as `commitPaths`; a partial file must be tracked (EUNTRACKED)
- * and not a rename, and a hunk the tree no longer has is EHUNKGONE.
+ * `body.hunks` checked for shape, and its files resolved as changed paths
+ * that may be taken in part: tracked (EUNTRACKED), not a rename, not in
+ * conflict, and not also named whole in `body.paths`.
 */
-async function commitSelection(dir, args, body) {
+async function partialPicks(dir, body, verb) {
  const picks = Object.entries(body.hunks);
  if (picks.length > MAX_PARTIAL_FILES) throw bad("EBADPATH", "too many files");
  for (const [, list] of picks) {
@@ -858,12 +858,54 @@ async function commitSelection(dir, args, body) {
  const conflicted = [...whole, ...part].find((p) => CONFLICT_CODES.has(p.code));
  if (conflicted) throw bad("ECONFLICTS", `${conflicted.path} is in conflict: resolve it first`);
  for (const p of part) {
-    if (p.code === "??") throw bad("EUNTRACKED", `${p.path} is untracked: commit it whole`);
-    if (p.code.includes("R")) throw bad("EBADPATH", `${p.path} is a rename: commit it whole`);
+    if (p.code === "??") throw bad("EUNTRACKED", `${p.path} is untracked: ${verb} it whole`);
+    if (p.code.includes("R")) throw bad("EBADPATH", `${p.path} is a rename: ${verb} it whole`);
    if (whole.some((w) => w.path === p.path)) {
      throw bad("EBADPATH", `${p.path} is named both whole and in part`);
    }
  }
+  return { picks, whole, part };
+}
+
+/**
+ * The partial discard (#87): per file in `hunks`, only the ticked change
+ * blocks are undone off the working tree — `selectionPatch` in reverse, git's
+ * own fresh text, never the request's — exactly what one `discard-hunk` per
+ * block would do, in one step. Every patch is built before the first is
+ * applied, so a stale selection refuses (EHUNKGONE) with nothing undone.
+ */
+async function discardSelection(dir, body) {
+  const { picks } = await partialPicks(dir, body, "discard");
+  const patches = [];
+  for (const [p, list] of picks) {
+    const patch = await selectionPatch(dir, p, body.context, list, true);
+    if (!patch)
+      throw bad("EHUNKGONE", `${p}: that change is no longer in the diff; refresh and retry`);
+    patches.push(patch);
+  }
+  // The patch names paths from the repo root, so it is applied there.
+  const top = (await git(dir, ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const zero = Number(body.context) === 0 ? ["--unidiff-zero"] : [];
+  const out = [];
+  for (const patch of patches)
+    out.push(await git(top, ["apply", "-R", ...zero, "-"], { input: patch }));
+  return mergeResults(out);
+}
+
+/**
+ * JetBrains' partial commit: whole files (`paths`) plus, per file in `hunks`,
+ * only the ticked change blocks — `{"<path>": [{hunk: "@@ … @@", blocks: [0]}]}`,
+ * the hunks named as `stage-hunk` names them, at `context`. Built in a
+ * TEMPORARY index (HEAD + the whole files + one patch per partial file from
+ * `selectionPatch`, git's own fresh text, never the request's) and committed
+ * from it, so the real index and the working tree are never in the way; after
+ * the commit the real index entries of exactly those paths are reset to the
+ * new HEAD, the rest of each partial file left as an unstaged change. Same
+ * path rules as `commitPaths`; a partial file must be tracked (EUNTRACKED)
+ * and not a rename, and a hunk the tree no longer has is EHUNKGONE.
+ */
+async function commitSelection(dir, args, body) {
+  const { picks, whole, part } = await partialPicks(dir, body, "commit");
  const wholePaths = whole.flatMap((p) =>
    p.from && p.code.includes("R") ? [p.path, p.from] : [p.path]
  );
@@ -5,7 +5,9 @@
 *
 * A workspace (`lanes.owner_id`) belongs to the user who created it. A session
 * belongs to its workspace: `sessions.lane_id`, or a `dashboard_runs` row of
- * that workspace holding it (a session not stamped yet). Agents, events and
+ * that workspace holding it (a session not stamped yet). A session no workspace owns
+ * belongs to the user of the Linux account it ran as (`sessions.account`,
+ * server/lib/session-account.js) — a script's `claude -p` is its runner's. Agents, events and
 * token rows belong to their session. A developer sees and changes only what
 * their own workspaces own; an analyst SEES everything but changes only their
 * own (every non-GET request is scoped like a developer's); an admin sees and
@@ -17,6 +19,7 @@
 */

 const sql = (q) => require("../db").db.prepare(q);
+const { ACCOUNT_OWNED } = require("./session-account");

 /** The user whose rows this request is limited to, or null for "all". */
 function memberId(req) {
@@ -53,8 +56,9 @@ function ownedSessionWhere(uid, col, laneCol) {
  return {
    where: `(${laneCol} IN (SELECT id FROM lanes WHERE owner_id = ?)
      OR ${col} IN (SELECT r.session_id FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id
-                     WHERE l.owner_id = ? AND r.session_id IS NOT NULL))`,
-    params: [uid, uid],
+                     WHERE l.owner_id = ? AND r.session_id IS NOT NULL)
+      OR ${col} IN (SELECT session_id FROM (${ACCOUNT_OWNED}) WHERE uid = ?))`,
+    params: [uid, uid, uid],
  };
 }

@@ -264,14 +268,16 @@ function ownerStillFits(laneId) {

 const STAFF = { staffOnly: true };

-/** Owner ids of the workspaces that own a session (stamped or held by a run). */
+/** Owner ids of a session: its workspace's (stamped or held by a run), else its account's user. */
 function sessionOwners(sessionId) {
  if (!sessionId) return new Set();
  const rows = sql(
    `SELECT l.owner_id FROM sessions s JOIN lanes l ON l.id = s.lane_id WHERE s.id = ?
     UNION
-     SELECT l.owner_id FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id WHERE r.session_id = ?`
-  ).all(String(sessionId), String(sessionId));
+     SELECT l.owner_id FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id WHERE r.session_id = ?
+     UNION
+     SELECT uid FROM (${ACCOUNT_OWNED}) WHERE session_id = ?`
+  ).all(String(sessionId), String(sessionId), String(sessionId));
  return new Set(rows.map((r) => r.owner_id).filter((x) => x != null));
 }

@@ -0,0 +1,113 @@
+/**
+ * @file session-account.js
+ * @description Which Linux account a session ran as (`sessions.account`: ""
+ * = the host's, else an S3 member's name), and whose bill a session no
+ * workspace owns goes on. A workspace owns a session through `lane_id` or a
+ * `dashboard_runs` row (server/lib/scope.js); a session started OUTSIDE every
+ * workspace — a script's `claude -p`, a CLI typed in a plain terminal — has
+ * neither, and without this its spend counted for nobody: not in anyone's
+ * Today, the Users page or a spend quota.
+ *
+ * The account is the hook's PEER (server/lib/hook-auth.js: the uid of the
+ * loopback connection, never the body) when a hook creates the session; a
+ * session no hook made (the Codex/Antigravity/Cursor/omp pollers, history)
+ * gets it from its folder, the S3 rule `accountForPath` already applies to
+ * every pane. A pushed session (another machine's) never gets one. A member
+ * account bills to the user of that name; the host account to the admin an
+ * admin marked as its owner (`users.host_account`), or — with no mark — the
+ * only enabled admin, if there is exactly one.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const sql = (q) => require("../db").db.prepare(q);
+
+// The user the host account's sessions bill to (null: nobody marked and not exactly one admin).
+const HOST_OWNER = `COALESCE(
+  (SELECT MIN(id) FROM users WHERE host_account = 1 AND role = 'admin'),
+  (SELECT MIN(id) FROM users WHERE role = 'admin' AND disabled = 0 HAVING COUNT(*) = 1))`;
+
+// A session no workspace owns: neither stamped onto an owned lane nor held by
+// a run of one — exactly the complement of scope.js's ownership.
+const UNOWNED = `(s.lane_id IS NULL OR s.lane_id NOT IN (SELECT id FROM lanes WHERE owner_id IS NOT NULL))
+  AND s.id NOT IN (SELECT r.session_id FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id
+                    WHERE r.session_id IS NOT NULL AND l.owner_id IS NOT NULL)`;
+
+/** `session_id` → `uid` for every session billed by its account (no workspace owns it). */
+const ACCOUNT_OWNED = `
+  SELECT s.id AS session_id, u.id AS uid
+    FROM sessions s JOIN users u
+      ON u.id = CASE WHEN s.account = '' THEN ${HOST_OWNER}
+                     ELSE (SELECT id FROM users WHERE username = s.account) END
+   WHERE s.account IS NOT NULL AND ${UNOWNED}`;
+
+/** The account a hook's peer names: "" for the host, a member's name, null otherwise. */
+function accountOfPeer(peer) {
+  if (!peer || peer.kind === "host") return "";
+  if (peer.kind === "member" && peer.name) return peer.name;
+  return null;
+}
+
+/** Record a hook-created session's account — first writer wins, a pushed hook never writes. */
+function stampFromPeer(sessionId, peer, pushSource = null) {
+  if (pushSource || !sessionId) return;
+  const account = accountOfPeer(peer);
+  if (account == null) return;
+  sql("UPDATE sessions SET account = ? WHERE id = ? AND account IS NULL").run(account, sessionId);
+}
+
+/** The account a folder runs as: "" outside the users root, a member's name inside it. */
+function accountOfPath(cwd) {
+  const linux = require("./linux-accounts");
+  const conf = linux.s3Enabled() ? linux.serverConf() : null;
+  const root = conf?.usersRoot;
+  const path = require("path");
+  if (!root || typeof cwd !== "string" || !path.isAbsolute(cwd)) return "";
+  const rel = path.relative(root, path.resolve(cwd));
+  if (rel.startsWith("..") || path.isAbsolute(rel)) return "";
+  // The users root itself is nobody's.
+  return rel.split(path.sep)[0] || null;
+}
+
+/**
+ * Give every local session still without an account the one its folder runs
+ * as (sessions the pollers made, and history from before the column). Cheap
+ * once caught up: only `account IS NULL` rows are read.
+ */
+function stampFromFolders() {
+  const rows = sql(
+    "SELECT id, cwd FROM sessions WHERE account IS NULL AND source NOT LIKE 'push:%' LIMIT 5000"
+  ).all();
+  if (!rows.length) return 0;
+  const set = sql("UPDATE sessions SET account = ? WHERE id = ? AND account IS NULL");
+  let n = 0;
+  require("../db").db.transaction(() => {
+    for (const r of rows) {
+      const account = accountOfPath(r.cwd);
+      if (account != null) n += set.run(account, r.id).changes;
+    }
+  })();
+  return n;
+}
+
+/** Mark `userId` (an admin) as the host account's owner, or clear the mark with null. */
+function setHostOwner(userId) {
+  require("../db").db.transaction(() => {
+    sql("UPDATE users SET host_account = 0 WHERE host_account = 1").run();
+    if (userId != null) sql("UPDATE users SET host_account = 1 WHERE id = ?").run(userId);
+  })();
+}
+
+/** The user id the host account bills to right now, or null. */
+function hostOwner() {
+  return sql(`SELECT ${HOST_OWNER} AS id`).get()?.id ?? null;
+}
+
+module.exports = {
+  ACCOUNT_OWNED,
+  accountOfPeer,
+  stampFromPeer,
+  accountOfPath,
+  stampFromFolders,
+  setHostOwner,
+  hostOwner,
+};
@@ -6,7 +6,9 @@
 * swap it back in later, touching nothing but that login.
 *
 *   - `codex`: the whole `$CODEX_HOME/auth.json` (a ChatGPT login or an API
- *     key). Config, sessions, skills and history stay where they are.
+ *     key). Config, sessions, skills and history stay where they are. A
+ *     switch then restarts Codex's shared app-server daemon when one runs,
+ *     so running and new sessions follow the new login (`follow`).
 *   - `omp`: every credential Oh My Pi stores, read with `omp auth export`
 *     and put back with `omp auth import -` (secrets on stdin, never argv).
 *     Import MERGES, so a switch first empties omp's own credential tables in
@@ -85,6 +87,15 @@ const codex = {
    writeJson(codexAuthFile(), secret);
    return [codexAuthFile()];
  },
+  // Codex ≥ 0.164 talks to the API through a shared app-server daemon that
+  // outlives every TUI and holds the login it started with: a new auth.json
+  // reached neither a running session nor a NEW one, which kept the old
+  // (often out-of-quota) account. Restarting the daemon makes it read the new
+  // login, and every open TUI reconnects to it on its own (verified on
+  // 0.164.0). No daemon running: nothing to restart — the next one reads the file.
+  follow() {
+    return restartCodexDaemon();
+  },
  identify(auth) {
    if (auth.tokens && auth.tokens.id_token) {
      const c = jwtClaims(auth.tokens.id_token) || {};
@@ -107,6 +118,26 @@ const codex = {
  },
 };

+/** The control socket's link points into a per-user runtime dir that exists only while a daemon runs. */
+const codexDaemonSocket = () =>
+  path.join(getCodexHome(), "app-server-control", "app-server-control.sock");
+
+/** Restart the CODEX_HOME's app-server daemon when one is running; true when a restart was started. */
+function restartCodexDaemon() {
+  if (!fs.existsSync(codexDaemonSocket())) return false;
+  const bin = process.env.AGENTHUB_CODEX_BIN || require("./ai-tools").detect("codex").path;
+  if (!bin) return false;
+  cp.execFile(
+    bin,
+    ["app-server", "daemon", "restart"],
+    { env: { ...process.env, CODEX_HOME: getCodexHome() }, timeout: 60000, windowsHide: true },
+    (e) => {
+      if (e) console.warn(`[tool-profiles] codex daemon restart failed: ${e.message}`);
+    }
+  );
+  return true;
+}
+
 // ── Oh My Pi ───────────────────────────────────────────────────────────

 const ompDir = () => process.env.AGENTHUB_OMP_DIR || path.join(os.homedir(), ".omp");
@@ -405,7 +436,9 @@ function activateProfile(tool, name) {
  }
  const target = readProfile(tool, name);
  const written = a.write(target.secret, live);
-  return { ok: true, name, savedOutgoing, written };
+  // `following`: running sessions take the new login without a restart of their own.
+  const following = typeof a.follow === "function" ? a.follow() : false;
+  return { ok: true, name, savedOutgoing, written, following };
 }

 function deleteProfile(tool, name) {
@@ -238,7 +238,7 @@ const paths = {
      summary: "Skills from files: a file, a folder, a .zip/.skill or several skills",
      operationId: "uploadArtifactSkills",
      description:
-        "`paths` is a JSON array of each file's relative path. Zip sizes are read before inflating; nothing is stored if any skill fails.",
+        "`paths` is a JSON array of each file's relative path. Zip sizes are read before inflating; nothing is stored if any skill fails. A skill whose name matches one the caller already has (not a workspace's) becomes that row's new version (`replaced: true`, `changed`) instead of a second row; `id` (Share again) puts the ONE uploaded skill onto that row, under the row's name.",
      requestBody: multipart(
        {
          files: { type: "array", items: { type: "string", format: "binary" } },
@@ -246,6 +246,7 @@ const paths = {
          name: { type: "string" },
          title: { type: "string" },
          description: { type: "string" },
+          id: { type: "string", description: "Share again: the skill row the upload replaces." },
        },
        ["files"]
      ),
@@ -790,6 +790,11 @@ const paths = {
        addWorkspaces: { type: "array", items: { type: "integer" } },
        removeWorkspaces: { type: "array", items: { type: "integer" } },
        signOut: { type: "boolean", enum: [true] },
+        hostAccount: {
+          type: "boolean",
+          description:
+            "An admin owns the host's Linux account: its sessions outside every workspace are billed to them (at most one; EBADROLE for a non-admin)",
+        },
        quota: { $ref: "#/components/schemas/UserQuotaSetting" },
      }),
      responses: {
@@ -1113,6 +1113,26 @@ const paths = {
      },
    },
  },
+  "/api/artifacts/{id}/reshare": {
+    post: {
+      tags: ["Artifacts"],
+      summary: "Share again: a skill's newest version from its owner's folder on this server",
+      operationId: "reshareArtifact",
+      description:
+        "The owner's skill folder (the row's source folder, else the same-named skill of a plugin the owner installed at user scope) becomes the new snapshot, and the row is shared (server mode); installers are then offered Update. 409 ENOSOURCE when the server has no copy: upload the folder with `id` on /api/artifacts/skill/upload. Same-origin only.",
+      parameters: [pathParam("id", "Artifact id.")],
+      responses: {
+        200: ok("Taken.", {
+          item: { type: "object" },
+          changed: { type: "boolean" },
+        }),
+        400: errs("EBADKIND."),
+        403: errs("EFORBIDDEN."),
+        404: errs("ENOTFOUND."),
+        409: errs("ENOSOURCE."),
+      },
+    },
+  },
  "/api/artifacts/{id}/claim": {
    post: {
      tags: ["Artifacts"],
@@ -489,6 +489,11 @@ const paths = {
                items: { type: "string" },
                description: "Files the switch wrote.",
              },
+              following: {
+                type: "boolean",
+                description:
+                  "Codex: a running app-server daemon was restarted, so open and new sessions use the new login.",
+              },
            },
          },
          "Switched."
@@ -39,6 +39,7 @@ const STATUS = {
  ENEEDLOGIN: 502,
  ETOOBIG: 413,
  EOWNED: 409,
+  ENOSOURCE: 409,
 };

 function sendError(res, err) {
@@ -229,6 +230,7 @@ router.post(
      name: b.name,
      title: b.title,
      description: b.description,
+      id: b.id,
    });
    for (const item of items) changed(item);
    res.status(201).json({ items });
@@ -284,6 +286,19 @@ router.patch(
  })
 );

+// Share again: the owner's skill folder on this server becomes the new
+// version (installers see Update); 409 ENOSOURCE when the server has none —
+// the client then uploads the folder onto this row (`/skill/upload` + `id`).
+router.post(
+  "/:id/reshare",
+  sameOriginGuard,
+  wrap((req, res) => {
+    const out = artifacts.reshareSkill(req, req.params.id);
+    changed(out.item);
+    res.json(out);
+  })
+);
+
 router.delete(
  "/:id",
  sameOriginGuard,
@@ -1643,6 +1643,8 @@ function ingestHook(body, pushSource = null, peer = { kind: "host" }) {
      } else {
        touchLaneFromHook(hook_type, data, tool, body.run_id, peer);
        bindRunSession(body.run_id, data.session_id, hook_type, data.source, tool);
+        // The Linux account it ran as: whose bill it is when no workspace owns it.
+        require("../lib/session-account").stampFromPeer(data.session_id, peer);
      }
    }
  } finally {
@@ -197,6 +197,7 @@ const { recordAccountChange } = require("../lib/audit");
 const ACCOUNT_STATUS = {
  EBADFIELD: 400,
  EBADEMAIL: 400,
+  ENAMETAKEN: 409,
  EBADPASSWORD: 400,
  EWEAKPASSWORD: 400,
  EBADIMAGE: 400,
@@ -262,6 +263,7 @@ router.patch(
  sameOriginGuard,
  accountWrite(async (_req, user, body) => {
    const fields = auth.validateProfile({ displayName: body.displayName, email: body.email });
+    auth.assertNameFree(user.id, fields);
    auth.setProfile(user.id, fields);
    return { out: accountView(user.id), action: "own profile" };
  })
@@ -702,7 +702,7 @@ router.get("/:id/file", async (req, res) => {
 function sessionStats(sessionId) {
  const totalEvents = stmts.sessionEventCount.get(sessionId)?.count ?? 0;
  const eventsByType = stmts.sessionEventTypeCounts.all(sessionId);
-  const tools = stmts.sessionToolUsageCounts.all(sessionId);
+  const tools = stmts.sessionToolUsageCounts.all(sessionId, sessionId);
  // Exact totals: `tools_used` is a top-15 list, so its sum is not the count.
  // A tool call is a PreToolUse; a session with none (imported) counts PostToolUse.
  const toolTotals = stmts.sessionToolCallTotals.get(sessionId) || {};
@@ -54,8 +54,9 @@ const { listAudit, recordAccountChange } = require("../lib/audit");

 const router = Router();

-// Which account each session belongs to — through its workspace, or a
-// dashboard run on one (server/lib/scope.js's sessionWhere, for every user at once).
+// Which account each session belongs to — through its workspace, a dashboard
+// run on one, or (no workspace owns it) the Linux account it ran as
+// (server/lib/scope.js's sessionWhere, for every user at once).
 const OWNED_SESSIONS = `
  SELECT s.id AS session_id, l.owner_id AS uid
    FROM sessions s JOIN lanes l ON l.id = s.lane_id
@@ -63,7 +64,9 @@ const OWNED_SESSIONS = `
  UNION
  SELECT s.id, l.owner_id
    FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id JOIN sessions s ON s.id = r.session_id
-   WHERE l.owner_id IS NOT NULL`;
+   WHERE l.owner_id IS NOT NULL
+  UNION
+  ${require("../lib/session-account").ACCOUNT_OWNED}`;

 /**
 * Map(user id → {cost, tokens}) per window, each window a UTC hour
@@ -171,6 +174,7 @@ router.get("/tmux", (_req, res) => {
 const STATUS = {
  EBADUSER: 400,
  EBADEMAIL: 400,
+  ENAMETAKEN: 409,
  ENOTOWNED: 409,
  EBADPASSWORD: 400,
  EWEAKPASSWORD: 400,
@@ -562,6 +566,7 @@ router.patch(

    // 1. Validate everything — nothing is written until all of it passes.
    const profile = auth.validateProfile(body);
+    auth.assertNameFree(u.id, profile);
    const roleChange = body.role !== undefined && body.role !== u.role;
    if (roleChange) {
      if (self) throw ESELF("you cannot change your own role");
@@ -578,6 +583,18 @@ router.patch(
      if (self && body.disabled) throw ESELF("you cannot disable yourself");
    }
    const disabledChange = body.disabled !== undefined && body.disabled !== Boolean(u.disabled);
+    if (body.hostAccount !== undefined) {
+      if (typeof body.hostAccount !== "boolean") {
+        throw Object.assign(new Error("hostAccount: true or false"), { code: "EBADFIELD" });
+      }
+      if (body.hostAccount && (body.role ?? u.role) !== "admin") {
+        throw Object.assign(new Error("only an admin can own the host account"), {
+          code: "EBADROLE",
+        });
+      }
+    }
+    const hostChange =
+      body.hostAccount !== undefined && body.hostAccount !== Boolean(u.host_account);
    if (body.password !== undefined) {
      // Your own password: every rule. Someone else's: a starting one they replace.
      if (self) {
@@ -617,6 +634,10 @@ router.patch(
      auth.setRole(u.username, body.role);
      done.push(`role ${body.role}`);
    }
+    if (hostChange) {
+      require("../lib/session-account").setHostOwner(body.hostAccount ? u.id : null);
+      done.push(body.hostAccount ? "owns the host account" : "no longer owns the host account");
+    }
    for (const id of add) auth.assignWorkspace(id, u.username);
    for (const id of remove) auth.unassignWorkspace(id, u.username);
    if (add.length) done.push(`workspace ${add.join(", ")}`);
Author	SHA1	Message	Date
nntrivi2001	bc44cbc8b7	chore: v2.8.45 — Share again updates a shared skill; a same-named upload updates it too	2026-10-30 14:20:51 +07:00
nntrivi2001	e7060a5e42	feat(artifacts): Share again takes a skill's newest version; a same-named upload updates it A shared skill followed its owner's ~/.claude/skills folder only, so one uploaded from a browser (or living in a plugin) stayed at its first snapshot for good. Share again (a skill's ⋯ menu and detail sheet) now takes the owner's copy on the server — its source folder, else the same-named skill of a plugin they installed at user scope — and shares it; with no copy it asks for the folder and uploads it onto that row (`id`). An upload whose skill is named like one the uploader already has replaces that row's version instead of adding a twin. Installers are then offered Update, as before.	2026-10-30 14:20:18 +07:00
nntrivi2001	4b8f59695b	chore: v2.8.44 — Discard in the Changes panel takes only the ticked files and blocks	2026-10-30 13:05:48 +07:00
nntrivi2001	da7b86d5c8	fix(changes): Discard takes only the ticked files and blocks (#87 ) The Changes panel's "Discard all" threw away every changed file, ticked or not. It is now "Discard (n)": the same selection Commit sends — whole ticked files as `paths`, a partly ticked file's ticked blocks as `hunks` — and is disabled with nothing ticked. The server's `discard` accepts `hunks` (`selectionPatch` in reverse, `git apply -R`), building every patch before applying any so a stale selection undoes nothing. Closes #87	2026-10-30 13:05:13 +07:00
nntrivi2001	efe21c79e9	chore: v2.8.43 — terminal glyphs stay sharp in every pane; a huge diff line no longer hides the rest	2026-10-30 10:34:51 +07:00
nntrivi2001	ee119fe437	fix(terminal): restamp every glyph-atlas page so no pane keeps a stale texture v2.8.42 reacted to a page merge by toggling the font family on the next frame, so each renderer re-acquired an atlas. Panes still showed squeezed, overlapping glyphs: the toggle lands a frame late, swaps every pane onto a fresh atlas (or onto one another pane already toggled to), and a page added without a merge shifts nothing yet still raced it. addon-webgl 0.20 fixes the root cause with globally monotonic page versions. Do the same on 0.19: whenever the shared atlas adds, removes or merges a page, give every page a version no texture slot has uploaded, synchronously, so every renderer on that atlas re-uploads all pages before it draws again. When the page comes back from the background, restamp and repaint. An addon of another shape keeps the old font-toggle fallback.	2026-10-30 10:33:57 +07:00
nntrivi2001	d97c403aab	fix(changes): a huge line no longer cuts the diff short; preview pages up to 64 MB A page that inlines a video as base64 has rows of megabytes. Its patch was read at the 200 KB per-file cap, so the first such row used the whole budget and every hunk after it was lost ("Diff cut short"). The patch is now read up to 16 M characters, rows over 4,000 characters are cut to 1,000 with an `elided` count the diff shows, and only then is the cap applied. Hunk actions re-read git's own diff by header and are unchanged. The HTML preview refused a page over 10 MB and showed only the file icon; a self-contained 18 MB slide deck now opens (limit 64 MB).	2026-10-30 10:28:53 +07:00
nntrivi2001	c41114faf8	chore: v2.8.42 — terminal glyphs stay sharp after the WebGL atlas fills up	2026-10-30 10:10:33 +07:00
nntrivi2001	c850f7603a	fix(terminal): re-upload the shared WebGL atlas after a page merge @xterm/addon-webgl 0.19 shares one glyph atlas between every terminal with the same font. When it fills, four pages are merged into a larger one and the rest shift down; a GPU texture is re-uploaded only when its page version differs, and those counters can coincide, so a slot keeps a stale page of another size and every glyph is drawn squeezed or foreign (fixed upstream only in the 0.20 betas). On a merge — and when the page comes back — toggle the font family's trailing space on the next frame, which makes each renderer re-acquire its atlas and re-upload all pages. This also drops yesterday's clearTextureAtlas on focus: it emptied the SHARED atlas but redrew only the calling pane, corrupting its siblings.	2026-10-30 10:09:28 +07:00
nntrivi2001	5463e354fa	chore: v2.8.41 — a session outside every workspace counts toward its user's spend	2026-10-30 08:50:58 +07:00
nntrivi2001	783b7f4101	fix(cost): bill a session outside every workspace to its Linux account's user A script's claude -p in a temp folder (the SG Flow eval runner strips the pane's env) had no workspace, so its spend reached nobody's Today, the Users page or a spend quota — ~$57 of a $74 day was missing from the status bar. sessions.account records the Linux account a session ran as (the hook's peer uid, else its folder for poller-made and old rows); a session no workspace owns is owned by that account's user — a member's to them, the host's to the admin ticked 'Owns this server's host account' (or the only admin). Workspace ownership still wins.	2026-10-30 08:50:34 +07:00
nntrivi2001	c28395402b	chore: v2.8.40 — a Codex account switch reaches running sessions	2026-10-29 15:59:19 +07:00
nntrivi2001	7798530528	fix(profiles): a Codex switch reaches running and new sessions Codex >= 0.164 sends every request through a shared app-server daemon that outlives its TUIs and keeps the login it started with, so writing a new auth.json changed nothing: open sessions and even new ones stayed on the old (out-of-quota) account. After a switch, restart that CODEX_HOME's daemon when one runs; open TUIs reconnect to it on their own (verified on 0.164.0 with two keys). The response says so (following), and the toast tells the user running sessions follow.	2026-10-29 15:54:20 +07:00
nntrivi2001	25f63d9ad3	fix(terminal): rebuild the WebGL glyph atlas when the page comes back A browser can drop the atlas's GPU memory without a context-loss event (sleep/resume, a long-backgrounded tab, display/zoom change on macOS), leaving every cell painted with a clipped or foreign glyph.	2026-10-29 15:44:16 +07:00
nntrivi2001	d060d288fb	fix(sessions): Top tools counts each tool call once The session analysis page's Top tools list counted every event carrying a tool_name, so each call was counted twice (its PreToolUse and its PostToolUse) while the Tool calls total beside it counted once — a session with 840 calls showed Bash at 1,533. The list now counts the same way as the total: PreToolUse, or PostToolUse in a session with none (imported).	2026-10-29 14:53:45 +07:00
nntrivi2001	6099841cef	fix(sessions): archiving a live session stops its pane Archive on a session a live pane held only hid its row, and the list deliberately does not bring such a tab back, so the pane kept running with nothing on screen showing it — a member archived five sessions believing them closed and kept ~2.7 GB of claude/omp/postgres-mcp alive for up to two days. Archive on a live session is now a Stop (endRuns, the tab X's confirm, DELETE /api/run/:id?archive=1) in the sidebar row, the workspace home's Recents and their right-click menu.	2026-10-29 14:26:25 +07:00
nntrivi2001	d70a7c9403	chore: v2.8.39 — no one can take a colleague's display name	2026-10-29 13:47:31 +07:00
nntrivi2001	63eaa739d4	fix(accounts): a display name may not read as another account's A member kept renaming themselves to a colleague's display name, plus "(you)", so the CPU/RAM card and every owner list showed two of that person. A display name is now refused (409 ENAMETAKEN) when, with marks, case, spaces, punctuation, bracketed parts and look-alike Cyrillic/Greek letters ignored, it equals another account's display name or username — in Settings → Account and on the Users page alike. Keeping the name one already has stays allowed, so an older clash does not block an admin's other edits.	2026-10-29 13:47:20 +07:00