chore: v2.8.70 — select combobox, chat turn end without Stop, no Stop flicker

Claude Code skips the Stop hook in roughly one turn in fifteen (only the
prompt-suggestion helper's SubagentStop arrives), so the main agent stayed
"working" until the idle Notification a minute later and the chat kept
showing Stop on a finished answer. The transcript's turn_duration entry is
now an end of turn too: one newer than the session's last prompt, read
while main still works with no tool open, lands it in Waiting like Stop.

The chat's Stop button now drops to Send only after every busy signal has
been quiet for 2.5 s (Stop pressed still drops at once), so a spinner line
that comes and goes while the CLI redraws no longer flips it back and forth,
and only the newest "working" read is applied.

client/src/components/BackgroundJobsDock.tsx

@@ -287,6 +287,11 @@ function UploadChip({ job }: { job: UploadJob }) {
       {isArmed("stop") && !stopping && (
         <p className="text-[11px] text-status-danger">{t("uploads.stopConfirm")}</p>
       )}
+      {job.waiting && !stopping && (
+        <p className="text-[11px] text-status-warning" role="status" data-testid="upload-waiting">
+          {t("uploads.waiting")}
+        </p>
+      )}
       <p className="truncate text-[11px] text-fg-muted" title={job.folder}>
         {job.folder}
         {job.name ? ` · ${job.name}` : ""}

client/src/components/NeedsYouStrip.tsx

@@ -1,7 +1,8 @@
 /**
  * @file NeedsYouStrip.tsx
  * @description The Dashboard's pinned "Needs you" strip: every active session
- * blocked on the user (`awaiting_input_since`), each linking straight to its
+ * of the viewer's OWN blocked on them (`awaiting_input_since`, `mine=1` — an
+ * admin's lists no other user's), each linking straight to its
  * workspace pane (or replay), else its analysis page. Renders nothing while no
  * session is waiting. `compact` is the one-line form shown above Analytics.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -27,7 +28,7 @@ export function NeedsYouStrip({ compact = false }: { compact?: boolean }) {
 
   const load = useCallback(() => {
     api.sessions
-      .list({ awaiting: true, limit: 20 })
+      .list({ awaiting: true, limit: 20, mine: true })
       .then((r) => {
         setSessions(r.sessions);
         setTotal(r.total);

client/src/components/Sagi/PetChat.tsx

@@ -1,595 +0,0 @@
-/**
- * @file PetChat.tsx
- * @description The pet's chat window — its whole UI: clicking the pet opens
- * it. Above the conversation sits what the pet knows (`info`: live / waiting /
- * errored, the sessions that need you, Mute, Clear alerts — `SagiInfo.tsx`).
- * Before a chat runs, a question the pet can answer itself (`onLocal`: status,
- * who are you…) is answered right here; anything else — and every message once
- * a chat runs — goes to the AI: the first message starts a
- * session of the user's DEFAULT AI tool (`agenthub.defaultTool`, Claude or
- * Codex — the two with a readable transcript) in the "Sagi" workspace, in its
- * first free tab (`startInFreeTabDetailed`), and the conversation is shown as
- * chat bubbles read from the session's transcript. Follow-ups are typed into
- * that session's pane through a terminal attached OFF-SCREEN (`TerminalView`
- * in a fixed box left of the viewport — `submitToRun` needs a mounted,
- * attached pane, exactly like the workspace's own Chat view), so nothing new
- * reaches the server. A menu the CLI asks with (a permission or trust prompt)
- * is read off that pane and answered with `PaneMenuCard`. The chat is kept in
- * `localStorage` (`agenthub.pet.chat`) while its pane lives, so closing and
- * reopening the window continues it; **New chat** STOPS that session (kills
- * its pane and archives it, asking first only mid-reply), **Open in workspace**
- * opens its pane there. Opening never resumes an ended session: once the pane
- * is gone, the next message starts a new one.
- * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
- */
-
-import { useCallback, useEffect, useRef, useState, type FormEvent, type ReactNode } from "react";
-import { useTranslation } from "react-i18next";
-import { ArrowUp, ExternalLink, Loader2, SquarePen, Wrench, X } from "lucide-react";
-import { api } from "../../lib/api";
-import type { TranscriptMessage } from "../../lib/types";
-import { readDefaultMode, readDefaultTool } from "../../lib/sessionDefaults";
-import {
-  answerRunMenu,
-  chooseRunOption,
-  interruptRun,
-  readRunMenu,
-  stepRunMenu,
-  submitToRun,
-  type PaneMenu,
-} from "../../lib/panePaste";
-import { isSubmitEnter } from "../../lib/keys";
-import { confirmDialog } from "../../lib/confirm";
-import { toast } from "../../lib/toast";
-import { startInFreeTabDetailed } from "../lanes/startSession";
-import { TerminalView } from "../run/TerminalView";
-import { PaneMenuCard } from "../run/PaneChat";
-import { MarkdownContent } from "../conversation/MarkdownContent";
-
-/** Tools whose session the chat can read back (a transcript AgentHub parses). */
-export const PET_CHAT_TOOLS = new Set(["claude", "codex"]);
-const CHAT_KEY = "agenthub.pet.chat";
-const POLL_MS = 1500;
-const MENU_POLL_MS = 700;
-// A follow-up waits this long for the off-screen pane to attach.
-const SEND_TRIES = 20;
-const SEND_RETRY_MS = 250;
-
-/** The session the chat is talking to. */
-export interface PetChatRef {
-  laneId: number;
-  runId: string;
-  tool: string;
-}
-
-export function readPetChat(): PetChatRef | null {
-  try {
-    const v = JSON.parse(localStorage.getItem(CHAT_KEY) ?? "null") as Partial<PetChatRef> | null;
-    if (
-      v &&
-      typeof v.laneId === "number" &&
-      typeof v.runId === "string" &&
-      typeof v.tool === "string"
-    )
-      return { laneId: v.laneId, runId: v.runId, tool: v.tool };
-  } catch {
-    /* unreadable: no chat */
-  }
-  return null;
-}
-
-function writePetChat(ref: PetChatRef | null) {
-  try {
-    if (ref) localStorage.setItem(CHAT_KEY, JSON.stringify(ref));
-    else localStorage.removeItem(CHAT_KEY);
-  } catch {
-    /* best-effort */
-  }
-}
-
-/** The tool a new chat starts: the user's default, when the chat can show it. */
-export function petChatTool(): string | null {
-  const tool = readDefaultTool() ?? "claude";
-  return PET_CHAT_TOOLS.has(tool) ? tool : null;
-}
-
-type Line =
-  | { key: string; role: "user" | "assistant"; text: string }
-  | { key: string; role: "tools"; names: string[] };
-
-/** A human line's text: Claude Code's own injected lines (`<command-…>`,
- *  `<system-reminder>`…) are not something the user said. */
-const humanText = (m: TranscriptMessage) =>
-  m.content
-    .filter((c) => c.type === "text" && c.text)
-    .map((c) => c.text!.trim())
-    .filter((t) => t && !t.startsWith("<"))
-    .join("\n\n");
-
-/** The transcript as chat lines: the user's words, the assistant's prose, and
- *  each run of tool calls between them folded into one chip. */
-export function chatLines(messages: TranscriptMessage[]): Line[] {
-  const out: Line[] = [];
-  messages.forEach((m, i) => {
-    const sender = m.sender ?? m.type;
-    if (sender === "user") {
-      const text = humanText(m);
-      if (text) out.push({ key: `u${i}`, role: "user", text });
-      return;
-    }
-    if (m.type !== "assistant") return;
-    m.content.forEach((c, j) => {
-      if (c.type === "text" && c.text?.trim()) {
-        out.push({ key: `a${i}-${j}`, role: "assistant", text: c.text.trim() });
-      } else if (c.type === "tool_use" && c.name) {
-        const last = out[out.length - 1];
-        if (last?.role === "tools") last.names.push(c.name);
-        else out.push({ key: `t${i}-${j}`, role: "tools", names: [c.name] });
-      }
-    });
-  });
-  return out;
-}
-
-/** Still working: the last line is the user's, or an assistant turn not ended. */
-function isBusy(messages: TranscriptMessage[]): boolean {
-  for (let i = messages.length - 1; i >= 0; i--) {
-    const m = messages[i]!;
-    const sender = m.sender ?? m.type;
-    if (m.type === "assistant") return m.stop_reason !== undefined && m.stop_reason !== "end_turn";
-    if (sender === "user" && humanText(m)) return true;
-  }
-  return false;
-}
-
-/** "Read ×2 · Bash" */
-function toolSummary(names: string[]): string {
-  const counts = new Map<string, number>();
-  names.forEach((n) => counts.set(n, (counts.get(n) ?? 0) + 1));
-  return [...counts].map(([n, c]) => (c > 1 ? `${n} ×${c}` : n)).join(" · ");
-}
-
-/** What the container made of a message: an answer the pet gives itself, or
- *  `handled` (it took the message elsewhere); null sends it to the AI. */
-export type PetLocalReply = { answer: string } | { handled: true } | null;
-
-interface PetChatProps {
-  /** The pet's shown name, for the header and greeting. */
-  name: string;
-  /** Shown in place of the plain name (the rename button). */
-  title?: ReactNode;
-  /** Extra header buttons, before Open in workspace (the pat heart). */
-  headerActions?: ReactNode;
-  /** Under the header: what the pet knows (status, sessions that need you). */
-  info?: ReactNode;
-  /** Asked first while no chat runs. */
-  onLocal?: (text: string) => PetLocalReply;
-  onClose: () => void;
-  /** Opens the chat's pane in its workspace. */
-  onOpenWorkspace: (laneId: number, runId: string) => void;
-  /** The thinking mood while a reply is being written. */
-  onBusy?: (busy: boolean) => void;
-}
-
-export function PetChat({
-  name,
-  title,
-  headerActions,
-  info,
-  onLocal,
-  onClose,
-  onOpenWorkspace,
-  onBusy,
-}: PetChatProps) {
-  const { t } = useTranslation("settings");
-  const [chat, setChat] = useState<PetChatRef | null>(readPetChat);
-  const [sessionId, setSessionId] = useState<string | null>(null);
-  const [messages, setMessages] = useState<TranscriptMessage[]>([]);
-  // Sent but not in the transcript yet.
-  const [pending, setPending] = useState<string | null>(null);
-  const [starting, setStarting] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [draft, setDraft] = useState("");
-  const [menu, setMenu] = useState<PaneMenu | null>(null);
-  // The pet's own answers, given before any chat ran.
-  const [local, setLocal] = useState<Line[]>([]);
-  const listRef = useRef<HTMLDivElement>(null);
-
-  const remember = (ref: PetChatRef | null) => {
-    writePetChat(ref);
-    setChat(ref);
-    setSessionId(null);
-    setMessages([]);
-    setMenu(null);
-  };
-
-  // A remembered chat whose pane is gone is over: forget it, the next message starts anew.
-  useEffect(() => {
-    if (!chat) return;
-    let live = true;
-    const check = () =>
-      api.run
-        .get(chat.runId)
-        .then((h) => {
-          if (!live) return;
-          if (h.status !== "running") remember(null);
-          else if (h.sessionId) setSessionId(h.sessionId);
-        })
-        .catch(() => live && remember(null));
-    void check();
-    // Codex learns its session only after a while; Claude's is known at start.
-    const timer = window.setInterval(() => {
-      if (!sessionId) void check();
-    }, POLL_MS);
-    return () => {
-      live = false;
-      window.clearInterval(timer);
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [chat?.runId, sessionId]);
-
-  // The conversation, polled while the window is open.
-  useEffect(() => {
-    if (!sessionId) return;
-    let live = true;
-    const load = () =>
-      api.sessions
-        .transcript(sessionId, { limit: 60 })
-        .then((r) => {
-          if (!live) return;
-          setMessages((prev) =>
-            prev.length === r.messages.length &&
-            JSON.stringify(prev[prev.length - 1]) ===
-              JSON.stringify(r.messages[r.messages.length - 1])
-              ? prev
-              : r.messages
-          );
-        })
-        .catch(() => undefined); // not started yet: the next poll asks again
-    void load();
-    const timer = window.setInterval(load, POLL_MS);
-    return () => {
-      live = false;
-      window.clearInterval(timer);
-    };
-  }, [sessionId]);
-
-  // A menu the CLI shows in the pane (permission, trust, a question).
-  useEffect(() => {
-    if (!chat) return;
-    const read = () =>
-      setMenu((prev) => {
-        const next = readRunMenu(chat.runId);
-        return JSON.stringify(next) === JSON.stringify(prev) ? prev : next;
-      });
-    const timer = window.setInterval(read, MENU_POLL_MS);
-    return () => window.clearInterval(timer);
-  }, [chat]);
-
-  const lines = [...local, ...chatLines(messages)];
-  // The pending line shows until the transcript has it.
-  useEffect(() => {
-    if (pending && lines.some((l) => l.role === "user" && l.text === pending.trim()))
-      setPending(null);
-  }, [lines, pending]);
-  const busy = starting || !!pending || isBusy(messages);
-  useEffect(() => onBusy?.(busy), [busy, onBusy]);
-  useEffect(() => () => onBusy?.(false), [onBusy]);
-
-  // Keep the newest in sight.
-  useEffect(() => {
-    const el = listRef.current;
-    if (el) el.scrollTop = el.scrollHeight;
-  }, [lines.length, pending, busy, menu]);
-
-  const send = useCallback(
-    async (text: string) => {
-      const prompt = text.trim();
-      if (!prompt || starting) return;
-      setError(null);
-      if (!chat && onLocal) {
-        const reply = onLocal(prompt);
-        if (reply && "handled" in reply) return;
-        if (reply) {
-          const n = Date.now();
-          setLocal((prev) => [
-            ...prev,
-            { key: `lu${n}`, role: "user", text: prompt },
-            { key: `la${n}`, role: "assistant", text: reply.answer },
-          ]);
-          return;
-        }
-      }
-      setPending(prompt);
-      if (chat) {
-        // Typed into the attached pane; it may still be attaching.
-        for (let i = 0; i < SEND_TRIES; i++) {
-          if (submitToRun(chat.runId, prompt)) return;
-          await new Promise((r) => setTimeout(r, SEND_RETRY_MS));
-        }
-        setPending(null);
-        setDraft(prompt);
-        setError(t("sagi.chat.notSent"));
-        return;
-      }
-      const tool = petChatTool() ?? "claude";
-      setStarting(true);
-      try {
-        const { lane } = await api.lanes.ensure({ title: "Sagi" });
-        const r = await startInFreeTabDetailed(lane.id, {
-          prompt,
-          ...(tool !== lane.tool ? { tool } : {}),
-          ...(tool === "claude" ? { permissionMode: readDefaultMode({ safe: true }) } : {}),
-        });
-        remember({ laneId: r.laneId, runId: r.runId, tool });
-      } catch (err) {
-        setPending(null);
-        setDraft(prompt);
-        setError(
-          t("sagi.startFailed", { error: err instanceof Error ? err.message : String(err) })
-        );
-      } finally {
-        setStarting(false);
-      }
-    },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [chat, starting, t, onLocal]
-  );
-
-  // New chat: the old one's session is stopped, not left running unseen —
-  // asking first only while it is still writing a reply.
-  const newChat = async () => {
-    if (chat) {
-      if (
-        busy &&
-        !(await confirmDialog({
-          title: t("sagi.chat.endTitle"),
-          message: t("sagi.chat.endBody"),
-          confirmLabel: t("sagi.chat.endConfirm"),
-          destructive: true,
-        }))
-      )
-        return;
-      try {
-        await api.run.kill(chat.runId, { archive: true });
-      } catch (err) {
-        toast.error(err);
-        return;
-      }
-    }
-    remember(null);
-    setLocal([]);
-    setPending(null);
-    setError(null);
-  };
-
-  const submit = (e?: FormEvent) => {
-    e?.preventDefault();
-    if (!draft.trim()) return;
-    const text = draft;
-    setDraft("");
-    void send(text);
-  };
-
-  const toolLabel = chat?.tool ?? petChatTool() ?? "claude";
-  const empty = lines.length === 0 && !pending;
-
-  return (
-    <div
-      className="pet-chat flex h-[30rem] max-h-[calc(100vh-6rem)] w-80 flex-col overflow-hidden rounded-3xl border border-border-light shadow-2xl animate-slide-up"
-      role="dialog"
-      aria-label={t("sagi.chat.label", { name })}
-    >
-      {/* header */}
-      <div className="pet-chat-head flex items-center gap-1 px-2 py-2">
-        <span className="pl-1.5 text-base leading-none" aria-hidden>
-          🐾
-        </span>
-        <div className="min-w-0 flex-1 px-1">
-          {title ?? <div className="truncate text-sm font-semibold text-fg-primary">{name}</div>}
-          <div className="flex items-center gap-1 text-[10px] uppercase tracking-wider text-fg-muted">
-            <span
-              className={`inline-block h-1.5 w-1.5 rounded-full ${
-                busy
-                  ? "animate-pulse bg-status-warning"
-                  : chat
-                    ? "bg-status-success"
-                    : "bg-fg-muted"
-              }`}
-              aria-hidden
-            />
-            {busy ? t("sagi.chat.typing") : toolLabel}
-          </div>
-        </div>
-        {headerActions}
-        {chat && (
-          <IconButton
-            label={t("sagi.chat.openWorkspace")}
-            onClick={() => onOpenWorkspace(chat.laneId, chat.runId)}
-          >
-            <ExternalLink size={15} />
-          </IconButton>
-        )}
-        <IconButton
-          label={t("sagi.chat.new")}
-          onClick={() => void newChat()}
-          disabled={(!chat && !local.length) || starting}
-        >
-          <SquarePen size={15} />
-        </IconButton>
-        <IconButton label={t("sagi.chat.close", { name })} onClick={onClose}>
-          <X size={16} />
-        </IconButton>
-      </div>
-
-      {info}
-
-      {/* conversation */}
-      <div ref={listRef} className="flex-1 space-y-2 overflow-y-auto px-3 py-3">
-        {empty && (
-          <div className="flex h-full flex-col items-center justify-center gap-2 px-4 text-center">
-            <span className="text-3xl" aria-hidden>
-              🐾
-            </span>
-            <p className="text-sm font-medium text-fg-primary">
-              {t("sagi.chat.emptyTitle", { name })}
-            </p>
-            <p className="text-xs text-fg-muted">{t("sagi.chat.emptyHint", { tool: toolLabel })}</p>
-          </div>
-        )}
-        {lines.map((l) =>
-          l.role === "tools" ? (
-            <div key={l.key} className="flex justify-start">
-              <span className="pet-chat-tools inline-flex max-w-[85%] items-center gap-1 truncate rounded-full px-2 py-0.5 text-[10px] text-fg-muted">
-                <Wrench size={10} className="shrink-0" aria-hidden />
-                <span className="truncate">{toolSummary(l.names)}</span>
-              </span>
-            </div>
-          ) : l.role === "user" ? (
-            <div key={l.key} className="flex justify-end">
-              <div className="max-w-[85%] whitespace-pre-wrap break-words rounded-2xl rounded-br-md bg-accent-solid px-3 py-2 text-sm text-white shadow-sm">
-                {l.text}
-              </div>
-            </div>
-          ) : (
-            <div key={l.key} className="flex justify-start">
-              <div className="pet-chat-reply max-w-[90%] break-words rounded-2xl rounded-bl-md px-3 py-2 text-sm text-fg-primary shadow-sm">
-                <MarkdownContent text={l.text} dense prose />
-              </div>
-            </div>
-          )
-        )}
-        {pending && (
-          <div className="flex justify-end">
-            <div className="max-w-[85%] whitespace-pre-wrap break-words rounded-2xl rounded-br-md bg-accent-solid px-3 py-2 text-sm text-white opacity-70 shadow-sm">
-              {pending}
-            </div>
-          </div>
-        )}
-        {busy && !menu && (
-          <div className="flex justify-start" aria-label={t("sagi.chat.typing")}>
-            <div className="pet-chat-reply flex gap-1 rounded-2xl rounded-bl-md px-3 py-3 shadow-sm">
-              <span className="pet-chat-dot" />
-              <span className="pet-chat-dot" />
-              <span className="pet-chat-dot" />
-            </div>
-          </div>
-        )}
-        {starting && (
-          <p className="flex items-center justify-center gap-1.5 text-[11px] text-fg-muted">
-            <Loader2 size={12} className="animate-spin" aria-hidden />
-            {t("sagi.chat.starting", { tool: toolLabel })}
-          </p>
-        )}
-        {chat && !sessionId && !starting && (
-          <p className="text-center text-[11px] text-fg-muted">{t("sagi.chat.notStarted")}</p>
-        )}
-      </div>
-
-      {error && (
-        <p className="mx-3 mb-1 rounded-lg bg-status-danger/10 px-2 py-1 text-[11px] text-status-danger">
-          {error}
-        </p>
-      )}
-
-      {/* prompt, or the question the CLI asks */}
-      <div className="pet-chat-foot px-2.5 py-2.5">
-        {menu && chat ? (
-          <div className="max-h-56 overflow-y-auto">
-            <PaneMenuCard
-              menu={menu}
-              onChoose={(i) => {
-                if (chooseRunOption(chat.runId, menu, i)) setMenu(null);
-                else setError(t("sagi.chat.notSent"));
-              }}
-              onAnswer={(text) => {
-                if (answerRunMenu(chat.runId, menu, text)) setMenu(null);
-                else setError(t("sagi.chat.notSent"));
-              }}
-              onStep={(dir) => {
-                if (!stepRunMenu(chat.runId, dir)) setError(t("sagi.chat.notSent"));
-              }}
-              onCancel={() => {
-                if (interruptRun(chat.runId)) setMenu(null);
-                else setError(t("sagi.chat.notSent"));
-              }}
-            />
-          </div>
-        ) : (
-          <form onSubmit={submit} className="flex items-end gap-1.5">
-            <textarea
-              rows={1}
-              autoFocus
-              className="max-h-28 min-h-[2.25rem] flex-1 resize-none rounded-2xl border border-border bg-surface-1 px-3.5 py-2 text-sm text-fg-primary placeholder-fg-muted focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/30"
-              placeholder={t("sagi.chat.placeholder", { name })}
-              aria-label={t("sagi.chat.placeholder", { name })}
-              value={draft}
-              onChange={(e) => setDraft(e.target.value)}
-              onKeyDown={(e) => {
-                if (isSubmitEnter(e) && !e.shiftKey) {
-                  e.preventDefault();
-                  submit();
-                } else if (e.key === "Escape") {
-                  e.stopPropagation();
-                  e.nativeEvent.stopImmediatePropagation();
-                  onClose();
-                }
-              }}
-            />
-            <button
-              type="submit"
-              disabled={!draft.trim() || starting}
-              className="flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-accent-solid text-white shadow-sm transition-opacity hover:opacity-90 disabled:opacity-40"
-              aria-label={t("sagi.panel.send")}
-            >
-              <ArrowUp size={16} />
-            </button>
-          </form>
-        )}
-      </div>
-
-      {/* The chat's pane, attached off-screen: the only way a follow-up or a
-          menu answer reaches it. A real size, so tmux does not shrink the pane. */}
-      {chat && (
-        <div className="pet-chat-term" aria-hidden>
-          <TerminalView
-            runId={chat.runId}
-            wsBaseUrl={window.location.origin.replace(/^http/, "ws")}
-            autoFocus={false}
-            // The pane ended: the conversation stays on screen, the next
-            // message starts a new session.
-            onExit={() => {
-              writePetChat(null);
-              setChat(null);
-            }}
-          />
-        </div>
-      )}
-    </div>
-  );
-}
-
-function IconButton({
-  label,
-  onClick,
-  disabled,
-  children,
-}: {
-  label: string;
-  onClick: () => void;
-  disabled?: boolean;
-  children: React.ReactNode;
-}) {
-  return (
-    <button
-      type="button"
-      className="rounded-full p-1.5 text-fg-muted transition-colors hover:bg-surface-4 hover:text-fg-primary disabled:cursor-not-allowed disabled:opacity-40"
-      onClick={onClick}
-      disabled={disabled}
-      aria-label={label}
-      title={label}
-    >
-      {children}
-    </button>
-  );
-}

client/src/components/Sagi/PetPanel.tsx

@@ -0,0 +1,62 @@
+/**
+ * @file PetPanel.tsx
+ * @description The pet's window — clicking the pet opens it: its name (which
+ * the user can rename), a pat button, and what the pet knows (`info`: live /
+ * waiting / errored, the sessions that need you, Mute, Clear alerts —
+ * `SagiInfo.tsx`). The pet no longer chats: it started a full AI session per
+ * question, a heavy process on a shared server, so the chat was removed
+ * (v2.8.68); this window is where the pet's own care comes next.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import type { ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { X } from "lucide-react";
+
+export function PetPanel({
+  name,
+  title,
+  headerActions,
+  info,
+  onClose,
+}: {
+  name: string;
+  /** The name line (a rename button); plain text without it. */
+  title?: ReactNode;
+  /** Buttons before Close (the pat). */
+  headerActions?: ReactNode;
+  /** What the pet knows (`SagiInfo`). */
+  info: ReactNode;
+  onClose: () => void;
+}) {
+  const { t } = useTranslation("settings");
+  return (
+    <div
+      className="pet-chat flex max-h-[calc(100vh-6rem)] w-[22rem] max-w-[calc(100vw-2rem)] flex-col overflow-hidden rounded-3xl border border-border-light shadow-2xl animate-slide-up"
+      role="dialog"
+      aria-label={t("sagi.panel.label", { name })}
+    >
+      <div className="pet-chat-head flex items-center gap-1 px-2 py-2">
+        <span className="pl-1.5 text-base leading-none" aria-hidden>
+          🐾
+        </span>
+        <div className="min-w-0 flex-1 px-1">
+          {title ?? <div className="truncate text-sm font-semibold text-fg-primary">{name}</div>}
+        </div>
+        {headerActions}
+        <button
+          type="button"
+          className="rounded-full p-1.5 text-fg-muted transition-colors hover:bg-surface-4 hover:text-fg-primary"
+          onClick={onClose}
+          aria-label={t("sagi.panel.close", { name })}
+          title={t("sagi.panel.close", { name })}
+        >
+          <X size={16} />
+        </button>
+      </div>
+      {/* Vertical only: an auto overflow-y makes x scrollable too, and the
+          status chips' row then showed a horizontal scrollbar. */}
+      <div className="min-w-0 overflow-y-auto overflow-x-hidden">{info}</div>
+    </div>
+  );
+}

client/src/components/Sagi/Sagi.tsx

@@ -5,9 +5,8 @@
  *   enabled; `Sagi` gates on the same preference itself, and the body (brain,
  *   tick, WS reducer) runs only while it is on. Persists across routes and
  *   shares the single WebSocket.
- *   Clicking the pet opens its chat window (`PetChat`), which is its whole UI:
- *   the status strip (`SagiInfo`) sits on top, a question the pet can answer
- *   itself is answered there, anything else goes to the AI.
+ *   Clicking the pet opens its window (`PetPanel`): its name, a pat, and the
+ *   status strip (`SagiInfo`). The pet no longer chats (v2.8.68).
  *   Owns the open/closed chat state, the ⌘B / Esc shortcuts, reduced-motion
  *   detection, and route navigation. Reactive personality + status/Ask come
  *   from useSagiBrain; the avatar is draggable (AssistiveTouch-style) via
@@ -15,10 +14,7 @@
  *   bubble/panel render in a self-clamping flyout so
  *   they never spill off any screen edge regardless of where the mascot is docked.
  *
- *   The "do the job" path: an unmatched question is the chat's — it starts a
- *   session of the default AI tool in the "Sagi" workspace; a default tool the
- *   chat cannot read back starts there and its session view opens
- *   (`/workspace?lane=<id>&run=<runId>`) — no new LLM backend. ⌘B/Ctrl+B is taken only while the mascot is shown and focus is not
+ *   ⌘B/Ctrl+B is taken only while the mascot is shown and focus is not
  *   in an editable field (a terminal's Ctrl+B is tmux's prefix).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
@@ -91,15 +87,12 @@ import { PetNameButton, SagiInfo } from "./SagiInfo";
 import { useSagiBrain } from "./useSagiBrain";
 import { useSagiPosition } from "./useSagiPosition";
 import { useSagiEnabled } from "./SagiMount";
-import { matchIntent } from "./intents";
 import { petName, sagiPrefs } from "./prefs";
 import type { SagiSubject } from "./brain";
 import { api } from "../../lib/api";
-import { readDefaultTool } from "../../lib/sessionDefaults";
-import { startInFreeTabDetailed } from "../lanes/startSession";
 import { workspaceHref } from "../SessionRowMenu";
 import { Heart } from "lucide-react";
-import { PetChat, petChatTool, type PetLocalReply } from "./PetChat";
+import { PetPanel } from "./PetPanel";
 
 // Stroking: this many left/right turns of the pointer over the pet, within
 // STROKE_MS and with no button held, is a pat; then a pause before the next.
@@ -229,7 +222,7 @@ function SagiBody() {
   // The name it goes by: the user's nickname, the pet's own, else Sagi.
   const [name, setName] = useState(() => petName(sagiPrefs.getPet()));
   const [size, setSize] = useState(() => sagiPrefs.getSize());
-  // The chat window (PetChat.tsx): the pet's whole UI.
+  // The pet's window (PetPanel.tsx).
   const [open, setOpen] = useState(false);
   // The right-click pet menu (`PetMenu.tsx`).
   const [menu, setMenu] = useState(false);
@@ -340,43 +333,6 @@ function SagiBody() {
     [brain, navigate]
   );
 
-  // Asked by the chat before any session runs.
-  const onLocal = useCallback(
-    (query: string): PetLocalReply => {
-      const result = matchIntent(query, brain.status, { name, attention: brain.attention });
-      if (result.kind === "answer") {
-        if (result.moment) brain.playMoment(result.moment);
-        return { answer: result.text };
-      }
-      // A question the pet cannot answer: the chat starts a session of the
-      // default AI tool and shows it as chat.
-      if (petChatTool()) return null;
-      // A default tool the chat cannot read back (not Claude/Codex): start it
-      // in the "Sagi" workspace and open its pane there, as before.
-      const prompt = result.prompt;
-      brain.setThinking(true);
-      (async () => {
-        try {
-          const { lane } = await api.lanes.ensure({ title: "Sagi" });
-          const tool = readDefaultTool();
-          const r = await startInFreeTabDetailed(lane.id, {
-            prompt,
-            ...(tool && tool !== lane.tool ? { tool } : {}),
-          });
-          navigate(`/workspace?lane=${r.laneId}&run=${encodeURIComponent(r.runId)}`);
-          setOpen(false);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          brain.setBubble(t("sagi.startFailed", { error: msg }));
-        } finally {
-          brain.setThinking(false);
-        }
-      })();
-      return { handled: true };
-    },
-    [brain, navigate, t, name]
-  );
-
   // Stroke the pet (move the pointer back and forth over it) to pat it.
   const stroke = useRef({ dir: 0, x: 0, turns: [] as number[], until: 0 });
   const onStroke = (e: React.PointerEvent) => {
@@ -398,8 +354,6 @@ function SagiBody() {
     s.dir = dir;
   };
 
-  const onBusy = useCallback((b: boolean) => brain.setThinking(b), [brain.setThinking]);
-
   const anchor: Anchor = {
     left: place.left,
     top: place.top,
@@ -412,11 +366,10 @@ function SagiBody() {
   return (
     <>
       {/* Beside the pet, riding along with it mid-drag too (SagiFlyout follows
-          it 1:1). Closing unmounts it; its chat is remembered, so reopening
-          re-attaches the same session. */}
+          it 1:1). */}
       {open && (
         <SagiFlyout anchor={anchor} beside>
-          <PetChat
+          <PetPanel
             name={name}
             title={
               <PetNameButton
@@ -449,13 +402,7 @@ function SagiBody() {
                 defaultOpen={brain.attention.length > 0}
               />
             }
-            onLocal={onLocal}
             onClose={() => setOpen(false)}
-            onOpenWorkspace={(laneId, runId) => {
-              navigate(`/workspace?lane=${laneId}&run=${encodeURIComponent(runId)}`);
-              setOpen(false);
-            }}
-            onBusy={onBusy}
           />
         </SagiFlyout>
       )}

client/src/components/Sagi/SagiInfo.tsx

@@ -1,6 +1,6 @@
 /**
  * @file SagiInfo.tsx
- * @description What the pet knows, shown inside its chat window (`PetChat`):
+ * @description What the pet knows, shown inside its window (`PetPanel`):
  *   the name you rename by clicking it (`PetNameButton`), and a status strip
  *   (`SagiInfo`) — live / waiting / errored counts and the connection state
  *   always in sight, and on expanding, the sessions that need the user, by
@@ -118,8 +118,8 @@ export function SagiInfo({
         className="flex w-full items-center gap-1.5 rounded-lg text-left"
         onClick={() => setOpen((v) => !v)}
         aria-expanded={open}
-        aria-label={t("sagi.chat.status")}
-        title={t("sagi.chat.status")}
+        aria-label={t("sagi.panel.status")}
+        title={t("sagi.panel.status")}
       >
         <StatChip
           icon={Radio}

client/src/components/Sagi/__tests__/PetChat.test.ts

@@ -1,46 +0,0 @@
-/**
- * @file PetChat.test.ts
- * @description Unit tests for the pet chat's transcript-to-bubbles folding (`chatLines`).
- * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
- */
-import { describe, it, expect } from "vitest";
-import { chatLines } from "../PetChat";
-import type { TranscriptMessage } from "../../../lib/types";
-
-const msg = (m: Partial<TranscriptMessage>): TranscriptMessage =>
-  ({ type: "user", timestamp: null, content: [], ...m }) as TranscriptMessage;
-
-describe("chatLines", () => {
-  it("keeps the user's words and the assistant's prose, folding tool calls into one chip", () => {
-    const lines = chatLines([
-      msg({ type: "user", sender: "user", content: [{ type: "text", text: "hi" }] }),
-      msg({
-        type: "assistant",
-        content: [
-          { type: "thinking", text: "hmm" },
-          { type: "tool_use", name: "Read" },
-        ],
-      }),
-      msg({ type: "user", sender: "tool", content: [{ type: "tool_result", output: "x" }] }),
-      msg({
-        type: "assistant",
-        content: [
-          { type: "tool_use", name: "Read" },
-          { type: "text", text: "hello!" },
-        ],
-      }),
-    ]);
-    expect(lines.map((l) => (l.role === "tools" ? l.names : l.text))).toEqual([
-      "hi",
-      ["Read", "Read"],
-      "hello!",
-    ]);
-  });
-
-  it("drops Claude Code's own injected lines", () => {
-    const lines = chatLines([
-      msg({ sender: "user", content: [{ type: "text", text: "<command-name>/clear</command-name>" }] }),
-    ]);
-    expect(lines).toEqual([]);
-  });
-});

client/src/components/Sagi/__tests__/Sagi.test.tsx

@@ -1,6 +1,6 @@
 /**
  * @file Sagi.test.tsx
- * @description Render tests for the Sagi companion component — mounting, mood rendering, the ⌘B chat toggle (the chat window is the pet's whole UI: status strip, local answers, New chat stopping the old session), and accessibility attributes.
+ * @description Render tests for the Sagi companion component — mounting, mood rendering, the ⌘B window toggle (the pet's window: name, pat, status strip — the pet no longer chats), and accessibility attributes.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -18,7 +18,6 @@ import { useSagiPosition } from "../useSagiPosition";
 import { MemoryRouter } from "react-router-dom";
 import { Sagi } from "../Sagi";
 import { eventBus } from "../../../lib/eventBus";
-import { api } from "../../../lib/api";
 import type { WSMessage, Session } from "../../../lib/types";
 
 function renderSagi() {
@@ -55,16 +54,15 @@ describe("Sagi widget", () => {
     expect(screen.getByRole("img", { name: /sagi/i })).toBeInTheDocument();
   });
 
-  it("opens the chat on click and answers a local status question there", () => {
+  it("opens its window on click — status, no chat box", () => {
     renderSagi();
     fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
-    const panel = screen.getByRole("dialog", { name: /chat with sagi/i });
-    expect(panel).toBeInTheDocument();
-
-    const input = within(panel).getByLabelText(/ask sagi anything/i);
-    fireEvent.change(input, { target: { value: "status" } });
-    fireEvent.submit(input.closest("form")!);
-    expect(within(panel).getByText(/live ·/i)).toBeInTheDocument();
+    const panel = screen.getByRole("dialog", { name: /pet sagi/i });
+    expect(within(panel).getByText("live")).toBeInTheDocument();
+    expect(within(panel).queryByRole("textbox")).toBeNull();
+    expect(within(panel).queryByRole("button", { name: /new chat/i })).toBeNull();
+    fireEvent.click(within(panel).getByRole("button", { name: /close sagi/i }));
+    expect(screen.queryByRole("dialog")).toBeNull();
   });
 
   it("toggles open/closed with Cmd/Ctrl+B and closes with Esc", () => {
@@ -89,7 +87,7 @@ describe("Sagi widget", () => {
     expect(within(btn).getByText("1")).toBeInTheDocument();
   });
 
-  it("names the errored session in its bubble and in the chat", () => {
+  it("names the errored session in its bubble and in its window", () => {
     renderSagi();
     act(() => {
       eventBus.publish({
@@ -102,7 +100,7 @@ describe("Sagi widget", () => {
     expect(within(bubble).getByText("Fix login")).toBeInTheDocument();
     expect(within(bubble).getByRole("button", { name: "Open" })).toBeInTheDocument();
     fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
-    const panel = screen.getByRole("dialog", { name: /chat with sagi/i });
+    const panel = screen.getByRole("dialog", { name: /pet sagi/i });
     expect(within(panel).getByText("Needs you")).toBeInTheDocument();
     expect(within(panel).getByRole("button", { name: /Fix login/ })).toBeInTheDocument();
   });
@@ -122,54 +120,17 @@ describe("Sagi widget", () => {
     expect(JSON.parse(localStorage.getItem("agenthub.pet.dismissedErrors")!)).toEqual(["a"]);
   });
 
-  it("renames the pet from the chat header", () => {
+  it("renames the pet from its window header", () => {
     renderSagi();
     fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
     fireEvent.click(screen.getByRole("button", { name: /rename sagi/i }));
     const input = screen.getByLabelText("Pet name");
     fireEvent.change(input, { target: { value: "Mochi" } });
     fireEvent.keyDown(input, { key: "Enter" });
-    expect(screen.getByRole("dialog", { name: /chat with mochi/i })).toBeInTheDocument();
-    expect(screen.getByLabelText(/ask mochi anything/i)).toBeInTheDocument();
+    expect(screen.getByRole("dialog", { name: /pet mochi/i })).toBeInTheDocument();
   });
 
-  it("hands a question it cannot answer to the AI", () => {
-    localStorage.setItem("agenthub.defaultTool", "claude");
-    const ensure = vi.spyOn(api.lanes, "ensure").mockReturnValue(new Promise(() => {}));
-    renderSagi();
-    fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
-    const chat = screen.getByRole("dialog", { name: /chat with sagi/i });
-    const input = within(chat).getByLabelText(/ask sagi anything/i);
-    fireEvent.change(input, { target: { value: "write me a haiku" } });
-    fireEvent.submit(input.closest("form")!);
-    expect(within(chat).getByText("write me a haiku")).toBeInTheDocument();
-    expect(ensure).toHaveBeenCalledWith({ title: "Sagi" });
-    ensure.mockRestore();
-  });
-
-  it("reopens the remembered chat, and New chat stops its session", async () => {
-    localStorage.setItem(
-      "agenthub.pet.chat",
-      JSON.stringify({ laneId: 7, runId: "agenthub-lane-7-1", tool: "claude" })
-    );
-    const get = vi
-      .spyOn(api.run, "get")
-      .mockReturnValue(new Promise(() => {}) as ReturnType<typeof api.run.get>);
-    const kill = vi.spyOn(api.run, "kill").mockResolvedValue({ ok: true });
-    renderSagi();
-    fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
-    expect(screen.getByRole("button", { name: /open in workspace/i })).toBeInTheDocument();
-    await act(async () => {
-      fireEvent.click(screen.getByRole("button", { name: /new chat/i }));
-    });
-    expect(kill).toHaveBeenCalledWith("agenthub-lane-7-1", { archive: true });
-    expect(localStorage.getItem("agenthub.pet.chat")).toBeNull();
-    expect(screen.queryByRole("button", { name: /open in workspace/i })).not.toBeInTheDocument();
-    get.mockRestore();
-    kill.mockRestore();
-  });
-
-  it("a pat shows its reaction on the pet even while the chat is open", () => {
+  it("a pat shows its reaction on the pet even while its window is open", () => {
     renderSagi();
     fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
     fireEvent.click(screen.getByRole("button", { name: /pat sagi/i }));
@@ -187,26 +148,40 @@ describe("Sagi widget", () => {
     expect(pet.querySelector(".sagi-reaction-text")).not.toBeNull();
   });
 
-  it("reflects the live count in the chat status", () => {
+  it("reflects the live count in its status", () => {
     renderSagi();
     act(() => {
       eventBus.publish(sessionMsg("a", "active"));
       eventBus.publish(sessionMsg("b", "active"));
     });
     fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
-    const panel = screen.getByRole("dialog", { name: /chat with sagi/i });
+    const panel = screen.getByRole("dialog", { name: /pet sagi/i });
     // The "live" stat chip shows value 2 next to its label.
     const liveChip = within(panel).getByText("live").closest("span.rounded-full")! as HTMLElement;
     expect(within(liveChip).getByText("2")).toBeInTheDocument();
   });
 
+  it("counts only the viewer's own sessions (another user's arrive marked mine: false)", () => {
+    renderSagi();
+    act(() => {
+      eventBus.publish({ ...sessionMsg("mine", "active"), mine: true });
+      eventBus.publish({ ...sessionMsg("theirs", "active"), mine: false });
+      eventBus.publish({ ...sessionMsg("theirs-err", "error"), mine: false });
+    });
+    fireEvent.click(screen.getByRole("button", { name: /open sagi companion/i }));
+    const panel = screen.getByRole("dialog", { name: /pet sagi/i });
+    const liveChip = within(panel).getByText("live").closest("span.rounded-full")! as HTMLElement;
+    expect(within(liveChip).getByText("1")).toBeInTheDocument();
+    expect(screen.queryByText(/theirs/)).toBeNull();
+  });
+
   it("respects the enabled preference", () => {
     localStorage.setItem("agent-dashboard-sagi-enabled", "false");
     renderSagi();
     expect(screen.queryByRole("button", { name: /open sagi companion/i })).not.toBeInTheDocument();
   });
 
-  it("a tap (no movement) still opens the chat", () => {
+  it("a tap (no movement) still opens its window", () => {
     renderSagi();
     const btn = screen.getByRole("button", { name: /open sagi companion/i });
     act(() => {
@@ -214,7 +189,7 @@ describe("Sagi widget", () => {
       fireEvent.pointerUp(btn, { clientX: 990, clientY: 700 });
     });
     fireEvent.click(btn);
-    expect(screen.getByRole("dialog", { name: /chat with sagi/i })).toBeInTheDocument();
+    expect(screen.getByRole("dialog", { name: /pet sagi/i })).toBeInTheDocument();
   });
 
   it("dragging snaps to an edge, persists position, and does not open the panel", () => {
@@ -243,7 +218,7 @@ describe("Sagi widget", () => {
       fireEvent.pointerUp(btn, { clientX: 992, clientY: 701 });
     });
     fireEvent.click(btn);
-    expect(screen.getByRole("dialog", { name: /chat with sagi/i })).toBeInTheDocument();
+    expect(screen.getByRole("dialog", { name: /pet sagi/i })).toBeInTheDocument();
     // No position was persisted because no real drag happened.
     expect(localStorage.getItem("agent-dashboard-sagi-pos")).toBeNull();
   });

client/src/components/Sagi/sagi.css

@@ -529,13 +529,10 @@
   z-index: 42;
 }
 
-/* ════════ the pet's chat window (PetChat.tsx) ════════ */
+/* ════════ the pet's window (PetPanel.tsx) ════════ */
 
-/* The reference's soft gradient, in the theme's own accent rather than a fixed
-   colour: a tint of the accent at the top fading into the surface, so it
-   reads in every light and dark theme. Replies sit on the plain surface like
-   the reference's white bubbles; the user's own are accent-solid (white text
-   is only ever on accent-solid). */
+/* A tint of the theme's accent at the top fading into the surface, so it
+   reads in every light and dark theme. */
 .pet-chat {
   background: linear-gradient(
     180deg,
@@ -547,61 +544,6 @@
 .pet-chat-head {
   border-bottom: 1px solid color-mix(in srgb, rgb(var(--accent)) 18%, transparent);
 }
-.pet-chat-reply {
-  background: rgb(var(--surface-0));
-  border: 1px solid color-mix(in srgb, rgb(var(--accent)) 12%, transparent);
-}
-.pet-chat-tools {
-  background: color-mix(in srgb, rgb(var(--surface-0)) 70%, transparent);
-  border: 1px dashed color-mix(in srgb, rgb(var(--accent)) 25%, transparent);
-}
-.pet-chat-foot {
-  background: rgb(var(--surface-0));
-  border-top: 1px solid rgb(var(--border) / 0.6);
-}
-/* Three bouncing dots while a reply is written. */
-.pet-chat-dot {
-  width: 6px;
-  height: 6px;
-  border-radius: 9999px;
-  background: rgb(var(--accent));
-  opacity: 0.5;
-  animation: pet-chat-dot 1.2s ease-in-out infinite;
-}
-.pet-chat-dot:nth-child(2) {
-  animation-delay: 0.15s;
-}
-.pet-chat-dot:nth-child(3) {
-  animation-delay: 0.3s;
-}
-@keyframes pet-chat-dot {
-  0%,
-  60%,
-  100% {
-    transform: translateY(0);
-    opacity: 0.35;
-  }
-  30% {
-    transform: translateY(-4px);
-    opacity: 0.9;
-  }
-}
-/* The chat's terminal, attached but off-screen. It keeps a real size (so tmux
-   does not shrink the pane to fit it) and a non-zero box (so the paste
-   registry counts it as on screen). */
-.pet-chat-term {
-  position: fixed;
-  left: -10000px;
-  top: 0;
-  width: 760px;
-  height: 460px;
-  pointer-events: none;
-}
-@media (prefers-reduced-motion: reduce) {
-  .pet-chat-dot {
-    animation: none;
-  }
-}
 
 /* ════════ a pat's reaction, drawn on the pet itself ════════ */
 

client/src/components/Sagi/useSagiBrain.ts

@@ -7,7 +7,8 @@
  *   burst of the same event into one count), the pet's one-shot animation
  *   "moment", and imperative controls (mute, clear alerts, pat, set thinking)
  *   for the UI shell. It also greets once per browser session and makes an
- *   idle pet fidget now and then.
+ *   idle pet fidget now and then. It only ever counts the viewer's OWN sessions
+ *   (`mine=1` seed, and frames marked `mine: false` skipped).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 /* =============================================================================
@@ -278,7 +279,7 @@ export function useSagiBrain(): SagiBrain {
       }, GREET_DELAY_MS);
     };
     api.sessions
-      .list({ status: "active", limit: 100 })
+      .list({ status: "active", limit: 100, mine: true })
       .then((res) => {
         if (cancelled) return;
         update((prev) => seedSessions(prev, res.sessions, Date.now()));
@@ -294,6 +295,9 @@ export function useSagiBrain(): SagiBrain {
   // Subscribe to the live stream and connection status.
   useEffect(() => {
     const unsubMsg = eventBus.subscribe((msg: WSMessage) => {
+      // Each user's pet tells only of their own sessions: an admin/analyst
+      // gets every user's, marked `mine: false` when not theirs.
+      if (msg.mine === false) return;
       const prev = stateRef.current;
       const { state: next, pulse, subject } = reduceSagi(prev, msg, Date.now());
       // Most frames only move lastActivityAt, which the moods read at a 1 s

client/src/components/Select.tsx

@@ -15,6 +15,14 @@
  * the next option whose label starts with it. Focus returns to the trigger on
  * every close except Tab.
  *
+ * ## Search — a combobox once the list is long
+ * With more than `SEARCH_FROM` options (or `searchable`), the popup opens with
+ * a search box on top, focused: typing narrows the list to options whose
+ * label or value contains the text (case-insensitive), ↑/↓ move, Enter picks,
+ * Escape closes. The box is `role="combobox"` controlling the listbox through
+ * `aria-activedescendant`. Options may carry a `group`: a heading is drawn
+ * where the group changes.
+ *
  * ## Consumers
  * Used on the Run Claude page and webhook settings form wherever a compact
  * enum picker is needed.
@@ -73,7 +81,11 @@
  * ----------------------------------------------------------------------------- */
 
 import { useEffect, useId, useRef, useState, type ReactNode } from "react";
-import { ChevronDown, Check } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { ChevronDown, Check, Search } from "lucide-react";
+
+/** A list longer than this gets a search box (unless `searchable` says otherwise). */
+export const SEARCH_FROM = 8;
 
 /** Room above and below `r` (the trigger's rect) for a menu it opens: inside
  *  the nearest `data-menu-bounds` box — a split pane, whose neighbour paints
@@ -95,6 +107,8 @@ export interface SelectOption<T extends string> {
   icon?: ReactNode;
   /** Draw a rule above this option: it starts a group of its own. */
   divider?: boolean;
+  /** The group this option belongs to: a heading is drawn where it changes. */
+  group?: string;
 }
 
 /** Props for {@link Select}. */
@@ -111,6 +125,10 @@ export interface SelectProps<T extends string> {
   variant?: "field" | "ghost";
   /** Accessible name and tooltip of the trigger (a ghost one has no label). */
   label?: string;
+  /** Show the search box: default only for lists longer than `SEARCH_FROM`. */
+  searchable?: boolean;
+  /** The search box's name and placeholder (default: "Search…"). */
+  searchLabel?: string;
 }
 
 /**
@@ -124,15 +142,26 @@ export function Select<T extends string>({
   disabled,
   variant = "field",
   label,
+  searchable,
+  searchLabel,
 }: SelectProps<T>) {
+  const { t } = useTranslation("common");
   const ghost = variant === "ghost";
+  const canSearch = searchable ?? options.length > SEARCH_FROM;
+  const [query, setQuery] = useState("");
   const [open, setOpen] = useState(false);
   const [active, setActive] = useState(0);
   const [openUp, setOpenUp] = useState(false);
   const containerRef = useRef<HTMLDivElement | null>(null);
   const buttonRef = useRef<HTMLButtonElement | null>(null);
   const listRef = useRef<HTMLDivElement | null>(null);
+  const searchRef = useRef<HTMLInputElement | null>(null);
   const typed = useRef({ text: "", at: 0 });
+  // The options shown: all of them, or those the search text matches.
+  const q = canSearch ? query.trim().toLowerCase() : "";
+  const shown = q
+    ? options.filter((o) => `${o.label} ${o.value}`.toLowerCase().includes(q))
+    : options;
   const id = useId();
   const optionId = (idx: number) => `${id}-opt-${idx}`;
 
@@ -150,6 +179,7 @@ export function Select<T extends string>({
   // above the trigger (288 px = `max-h-72`), and move focus into the list.
   useEffect(() => {
     if (!open) return;
+    setQuery("");
     const idx = options.findIndex((o) => o.value === value);
     setActive(idx >= 0 ? idx : 0);
     if (buttonRef.current) {
@@ -159,14 +189,14 @@ export function Select<T extends string>({
       );
       setOpenUp(below < 288 && above > below);
     }
-    listRef.current?.focus({ preventScroll: true });
+    (canSearch ? searchRef.current : listRef.current)?.focus({ preventScroll: true });
     // eslint-disable-next-line react-hooks/exhaustive-deps -- only on open
   }, [open]);
 
   useEffect(() => {
     if (open) document.getElementById(optionId(active))?.scrollIntoView?.({ block: "nearest" });
     // eslint-disable-next-line react-hooks/exhaustive-deps -- id is stable
-  }, [open, active]);
+  }, [open, active, q]);
 
   const close = (refocus = true) => {
     setOpen(false);
@@ -185,8 +215,12 @@ export function Select<T extends string>({
     }
   };
 
-  const onListKey = (e: React.KeyboardEvent<HTMLDivElement>) => {
-    const last = options.length - 1;
+  const onListKey = (e: React.KeyboardEvent<HTMLElement>) => {
+    const last = shown.length - 1;
+    // In the search box, keys that edit text stay the box's own.
+    const inSearch = e.currentTarget === searchRef.current;
+    if (inSearch && (e.key === " " || e.key === "Home" || e.key === "End")) return;
+    if (inSearch && e.key === "Enter" && e.nativeEvent.isComposing) return;
     const move: Record<string, (a: number) => number> = {
       ArrowDown: (a) => Math.min(last, a + 1),
       ArrowUp: (a) => Math.max(0, a - 1),
@@ -200,7 +234,7 @@ export function Select<T extends string>({
       setActive(move[e.key]!);
     } else if (e.key === "Enter" || e.key === " ") {
       e.preventDefault();
-      const opt = options[active];
+      const opt = shown[active];
       if (opt) choose(opt);
     } else if (e.key === "Escape") {
       // Stop here: a Select inside a dialog must not close the dialog too.
@@ -209,7 +243,7 @@ export function Select<T extends string>({
       close();
     } else if (e.key === "Tab") {
       close(false);
-    } else if (e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
+    } else if (!inSearch && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
       // Type-ahead: keys typed within 500 ms build one prefix; a repeated single
       // character cycles through the options that start with it.
       const now = Date.now();
@@ -258,57 +292,100 @@ export function Select<T extends string>({
       </button>
       {open && (
         <div
-          ref={listRef}
-          id={`${id}-list`}
-          role="listbox"
-          tabIndex={-1}
-          aria-label={label}
-          aria-activedescendant={options[active] ? optionId(active) : undefined}
-          onKeyDown={onListKey}
-          onBlur={(e) => {
-            if (!containerRef.current?.contains(e.relatedTarget as Node | null)) setOpen(false);
-          }}
-          className={`absolute z-30 left-0 ${ghost ? "w-max min-w-[12rem] max-w-[20rem]" : "right-0"} rounded-md border border-border bg-surface-1 shadow-lg shadow-black/40 max-h-72 overflow-auto py-1 outline-none ${
+          className={`absolute z-30 left-0 ${ghost ? "w-max min-w-[12rem] max-w-[20rem]" : "right-0"} flex max-h-72 flex-col overflow-hidden rounded-md border border-border bg-surface-1 shadow-lg shadow-black/40 ${
             openUp ? "bottom-full mb-1" : "top-full mt-1"
           }`}
         >
-          {options.map((opt, idx) => {
-            const isSelected = opt.value === value;
-            const isActive = idx === active;
-            return (
-              <div
-                key={opt.value || "__default__"}
-                id={optionId(idx)}
-                role="option"
-                aria-selected={isSelected}
-                onMouseDown={(e) => e.preventDefault()}
-                onClick={() => choose(opt)}
-                onMouseEnter={() => setActive(idx)}
-                className={`w-full cursor-pointer text-left px-3 py-1.5 transition-colors ${
-                  opt.divider ? "mt-1 border-t border-border pt-2" : ""
-                } ${
-                  isActive ? "bg-accent/15" : isSelected ? "bg-surface-3" : "hover:bg-surface-3"
-                }`}
-              >
-                <div className="flex items-center gap-2">
-                  {opt.icon}
-                  <span
-                    className={`text-[11px] flex-1 truncate ${
-                      isSelected ? "text-accent font-medium" : "text-fg-secondary"
+          {canSearch && (
+            <div className="flex shrink-0 items-center gap-1.5 border-b border-border px-2.5 py-1.5">
+              <Search className="h-3 w-3 shrink-0 text-fg-muted" aria-hidden />
+              <input
+                ref={searchRef}
+                role="combobox"
+                aria-label={searchLabel ?? t("select.search")}
+                aria-expanded
+                aria-controls={`${id}-list`}
+                aria-autocomplete="list"
+                aria-activedescendant={shown[active] ? optionId(active) : undefined}
+                placeholder={searchLabel ?? t("select.search")}
+                value={query}
+                onChange={(e) => {
+                  setQuery(e.target.value);
+                  setActive(0);
+                }}
+                onKeyDown={onListKey}
+                onBlur={(e) => {
+                  if (!containerRef.current?.contains(e.relatedTarget as Node | null))
+                    setOpen(false);
+                }}
+                className="min-w-0 flex-1 bg-transparent text-[11px] text-fg-primary placeholder:text-fg-muted focus:outline-none"
+              />
+            </div>
+          )}
+          <div
+            ref={listRef}
+            id={`${id}-list`}
+            role="listbox"
+            tabIndex={-1}
+            aria-label={label}
+            aria-activedescendant={!canSearch && shown[active] ? optionId(active) : undefined}
+            onKeyDown={onListKey}
+            onBlur={(e) => {
+              if (!containerRef.current?.contains(e.relatedTarget as Node | null)) setOpen(false);
+            }}
+            className="min-h-0 flex-1 overflow-auto py-1 outline-none"
+          >
+            {canSearch && shown.length === 0 && (
+              <div className="px-3 py-1.5 text-[11px] text-fg-muted">{t("select.noMatch")}</div>
+            )}
+            {shown.map((opt, idx) => {
+              const isSelected = opt.value === value;
+              const isActive = idx === active;
+              const heading = opt.group && opt.group !== shown[idx - 1]?.group ? opt.group : null;
+              return (
+                <div key={opt.value || "__default__"} role="none">
+                  {heading && (
+                    <div
+                      role="presentation"
+                      className="mt-1 border-t border-border px-3 pb-0.5 pt-1.5 text-[10px] font-medium text-fg-muted"
+                    >
+                      {heading}
+                    </div>
+                  )}
+                  <div
+                    id={optionId(idx)}
+                    role="option"
+                    aria-selected={isSelected}
+                    onMouseDown={(e) => e.preventDefault()}
+                    onClick={() => choose(opt)}
+                    onMouseEnter={() => setActive(idx)}
+                    className={`w-full cursor-pointer text-left px-3 py-1.5 transition-colors ${
+                      opt.divider ? "mt-1 border-t border-border pt-2" : ""
+                    } ${
+                      isActive ? "bg-accent/15" : isSelected ? "bg-surface-3" : "hover:bg-surface-3"
                     }`}
                   >
-                    {opt.label}
-                  </span>
-                  {isSelected && (
-                    <Check className="w-3 h-3 text-accent flex-shrink-0" aria-hidden />
-                  )}
+                    <div className="flex items-center gap-2">
+                      {opt.icon}
+                      <span
+                        className={`text-[11px] flex-1 truncate ${
+                          isSelected ? "text-accent font-medium" : "text-fg-secondary"
+                        }`}
+                      >
+                        {opt.label}
+                      </span>
+                      {isSelected && (
+                        <Check className="w-3 h-3 text-accent flex-shrink-0" aria-hidden />
+                      )}
+                    </div>
+                    {opt.hint && (
+                      <div className="text-[10px] text-fg-muted truncate mt-0.5">{opt.hint}</div>
+                    )}
+                  </div>
                 </div>
-                {opt.hint && (
-                  <div className="text-[10px] text-fg-muted truncate mt-0.5">{opt.hint}</div>
-                )}
-              </div>
-            );
-          })}
+              );
+            })}
+          </div>
         </div>
       )}
     </div>

client/src/components/StatusBar.tsx

@@ -4,7 +4,8 @@
  * which the sidebar owns and which also carries the update check), the version
  * — with a green dot while a newer release is out —, how many SESSIONS are
  * running and how many need the user (`GET /api/sessions?status=active` and
- * `?awaiting=1` — the Dashboard's Needs-you rule —, re-read on session
+ * `?awaiting=1` — the Dashboard's Needs-you rule —, both `&mine=1`: the user's
+ * OWN sessions even for an admin —, re-read on session
  * messages), and today's spend — `GET /api/pricing/cost?date=<local date>&mine=1`, the
  * user's OWN spend even for an admin — and, on the
  * Workspace page, the open workspace's total (`?lane=` on the same call: the
@@ -388,11 +389,11 @@ export function StatusBar({
 
   const loadCounts = useCallback(() => {
     api.sessions
-      .list({ status: "active", limit: 1 })
+      .list({ status: "active", limit: 1, mine: true })
       .then((r) => setActive(r.total))
       .catch(() => undefined);
     api.sessions
-      .list({ awaiting: true, limit: 1 })
+      .list({ awaiting: true, limit: 1, mine: true })
       .then((r) => setNeedYou(r.total))
       .catch(() => undefined);
   }, []);

client/src/components/WebhookSettings.tsx

@@ -559,6 +559,8 @@ export function WebhookSettings() {
                       headerRows: [],
                     })
                   }
+                  // A short, fixed list of providers: no search box.
+                  searchable={false}
                   options={providers.map((p) => ({ value: p.type, label: p.label }))}
                 />
               </div>

client/src/components/__tests__/Select.test.tsx

@@ -105,7 +105,61 @@ describe("Select (listbox button)", () => {
     vi.spyOn(button, "getBoundingClientRect").mockReturnValue(rect(360, 380));
     vi.stubGlobal("innerHeight", 2000);
     fireEvent.click(button);
-    expect(screen.getByRole("listbox").className).toContain("bottom-full");
+    expect(screen.getByRole("listbox").parentElement!.className).toContain("bottom-full");
     vi.unstubAllGlobals();
   });
+
+  it("turns a long list into a combobox: type to narrow, Enter picks, groups keep headings", async () => {
+    const onChange = vi.fn();
+    const options = [
+      { value: "", label: "Switch branch…" },
+      ...["develop", "main", "feat/campaign-pause", "fix/campaign-step", "chore/a", "chore/b"].map(
+        (v) => ({ value: v, label: v })
+      ),
+      ...["origin/feat/campaign-statistic", "origin/x", "origin/y"].map((v) => ({
+        value: v,
+        label: v,
+        group: "On the remote",
+      })),
+    ];
+    render(<Select value="" onChange={onChange} options={options} label="Switch branch…" />);
+    fireEvent.click(screen.getByRole("button", { name: "Switch branch…" }));
+    const search = screen.getByRole("combobox", { name: "Search…" });
+    expect(search).toHaveFocus();
+    expect(screen.getByText("On the remote")).toBeInTheDocument();
+
+    fireEvent.change(search, { target: { value: "CAMPAIGN" } });
+    expect(screen.getAllByRole("option").map((o) => o.textContent)).toEqual([
+      "feat/campaign-pause",
+      "fix/campaign-step",
+      "origin/feat/campaign-statistic",
+    ]);
+    fireEvent.keyDown(search, { key: "ArrowDown" });
+    fireEvent.keyDown(search, { key: "Enter" });
+    expect(onChange).toHaveBeenCalledWith("fix/campaign-step");
+    expect(screen.queryByRole("listbox")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Switch branch…" }));
+    fireEvent.change(screen.getByRole("combobox"), { target: { value: "zzz" } });
+    expect(screen.getByText("No match")).toBeInTheDocument();
+    fireEvent.keyDown(screen.getByRole("combobox"), { key: "Escape" });
+    expect(screen.queryByRole("listbox")).toBeNull();
+  });
+
+  it("keeps a short list a plain listbox (no search box)", () => {
+    render(
+      <Select
+        value="a"
+        onChange={vi.fn()}
+        options={[
+          { value: "a", label: "A" },
+          { value: "b", label: "B" },
+        ]}
+        label="Pick"
+      />
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Pick" }));
+    expect(screen.queryByRole("combobox")).toBeNull();
+    expect(screen.getByRole("listbox")).toHaveFocus();
+  });
 });

client/src/components/__tests__/StatusBar.test.tsx

@@ -183,6 +183,9 @@ describe("StatusBar", () => {
     );
     await screen.findByText("1 need you");
     expect(screen.getByTestId("status-bar-counts").textContent).toBe("2 running · 1 need you");
+    // The user's OWN sessions, even for an admin who sees every user's rows.
+    for (const [p] of vi.mocked(api.sessions.list).mock.calls)
+      expect(p).toMatchObject({ mine: true });
     await user.click(conn);
     expect(onConnectionClick).toHaveBeenCalled();
     // Polite live region: the connection and who is waiting, nothing that ticks.

client/src/components/conversation/MarkdownContent.tsx

@@ -63,6 +63,7 @@
 
 import React from "react";
 import { CodeBlock } from "./CodeBlock";
+import { onLinkClick } from "../../lib/openInPreview";
 
 type Block =
   | { kind: "code"; lang: string; code: string }
@@ -305,7 +306,13 @@ const LABEL_CLASS = (word: string) =>
 
 function UrlLink({ url }: { url: string }) {
   return (
-    <a href={url} target="_blank" rel="noopener noreferrer" className={LINK_CLASS}>
+    <a
+      href={url}
+      target="_blank"
+      rel="noopener noreferrer"
+      onClick={(e) => onLinkClick(e, url)}
+      className={LINK_CLASS}
+    >
       {url}
     </a>
   );
@@ -466,6 +473,7 @@ function renderInline(text: string, baseKey = ""): React.ReactNode[] {
           href={href}
           target="_blank"
           rel="noopener noreferrer"
+          onClick={(e) => onLinkClick(e, href)}
           className="text-violet-700 dark:text-violet-300 hover:text-violet-800 dark:hover:text-violet-200 underline underline-offset-2 decoration-violet-400/40 hover:decoration-violet-300/70"
         >
           {renderInline(linkM[1]!, `${baseKey}-l${n}`)}

client/src/components/conversation/MessageList.tsx

@@ -865,7 +865,7 @@ function MessageListView({
           className={
             compact
               ? "space-y-3 py-1 pr-2"
-              : "mx-auto flex w-full max-w-3xl flex-col gap-3 px-4 py-6"
+              : "mx-auto flex w-full max-w-5xl flex-col gap-3 px-4 py-6"
           }
         >
           {items.map((item) => {

client/src/components/health/HostHealth.tsx

@@ -11,7 +11,9 @@
  * GPUs), disks (how full, read / write rate) with network interfaces, and the
  * busiest processes with who each counts for (history, CPU threads and
  * processes are Linux-only reads, so off Linux those cards are left out); and — server mode — each user's
- * live CPU / RAM share (a tile per user; click for their busiest processes). Also exports `useHostStats` (a poll every `pollMs` while
+ * live CPU / RAM share (a tile per user; click for their busiest processes; hover
+ * for — admin/analyst, from `GET /api/users` — their role, $ spent today,
+ * workspaces, sessions and last sign-in). Also exports `useHostStats` (a poll every `pollMs` while
  * the tab is visible; 0 = read once), `Meter`, `pct` and `fmtPct`, which the
  * Administration users table shares for each home's share of the homes disk.
  * Read-only.
@@ -38,14 +40,17 @@ import {
   type HostHistoryRange,
   type HostStats,
   type HostUsageGroup,
+  type ServerUserUsage,
 } from "../../lib/api";
-import { formatBytes, formatDateTime } from "../../lib/format";
+import { fmt, fmtCost, formatBytes, formatDateTime } from "../../lib/format";
+import { usePermissions } from "../AuthGate";
 import { Tip } from "../Tip";
 import { MiniChart } from "../admin/MiniChart";
 import { UserAvatar } from "../users/UserAvatar";
 
 const POLL_MS = 5000;
 const HISTORY_POLL_MS = 30000;
+const USERS_POLL_MS = 60000;
 const RANGES: HostHistoryRange[] = ["1h", "6h", "24h"];
 
 export const pct = (part: number, whole: number) => (whole > 0 ? (part / whole) * 100 : 0);
@@ -324,6 +329,25 @@ export function HostSections({ host, heap }: { host: HostState; heap?: HeapInfo
   const [history, setHistory] = useState<HostHistory | null>(null);
   // The user tile whose busiest processes are shown.
   const [open, setOpen] = useState<string | null>(null);
+  // Each account's role and spend for the tiles' hover card. `GET /api/users`
+  // is admin/analyst only, so a developer gets no card.
+  const { seesAll, local } = usePermissions();
+  const { t: tu } = useTranslation("users");
+  const [accounts, setAccounts] = useState<Map<number, ServerUserUsage>>(new Map());
+  const hasPeople = (stats?.usage?.groups ?? []).some((g) => g.kind === "user");
+  useEffect(() => {
+    if (!seesAll || local || !hasPeople) return;
+    const load = () =>
+      api.users
+        .list()
+        .then((r) => setAccounts(new Map(r.users.map((u) => [u.id, u]))))
+        .catch(() => {});
+    void load();
+    const id = setInterval(() => {
+      if (document.visibilityState === "visible") void load();
+    }, USERS_POLL_MS);
+    return () => clearInterval(id);
+  }, [seesAll, local, hasPeople]);
 
   const loadHistory = useCallback(
     () =>
@@ -365,6 +389,29 @@ export function HostSections({ host, heap }: { host: HostState; heap?: HeapInfo
     if (key === "system") return t("host.systemGroup");
     return key;
   };
+  const userTip = (g: HostUsageGroup) => {
+    const u = g.userId != null ? accounts.get(g.userId) : undefined;
+    // No account row (a developer, or not read yet): no card at all.
+    if (!u) return "";
+    const lines = [groupName(g)];
+    {
+      lines.push(
+        t("host.userTipRole", { v: tu(`roles.${u.role}`) }) +
+          (u.disabled ? ` · ${t("host.userTipDisabled")}` : "")
+      );
+      if (u.today)
+        lines.push(
+          t("host.userTipToday", { cost: fmtCost(u.today.cost), tokens: fmt(u.today.tokens) })
+        );
+      lines.push(t("host.userTipWork", { w: u.workspaces, s: u.sessions }));
+      lines.push(
+        t("host.userTipLastLogin", {
+          v: u.lastLoginAt ? formatDateTime(u.lastLoginAt) : t("host.userTipNever"),
+        })
+      );
+    }
+    return lines.join("\n");
+  };
   const perSec = (v: number) => t("host.perSecond", { v: formatBytes(v) });
   const timeLabel = (iso: string) =>
     new Date(iso).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
@@ -676,26 +723,30 @@ export function HostSections({ host, heap }: { host: HostState; heap?: HeapInfo
               const isOpen = open === g.key;
               return (
                 <div key={g.key} className="space-y-2" data-testid="server-user">
-                  <button
-                    type="button"
-                    onClick={() => setOpen(isOpen ? null : g.key)}
-                    disabled={!g.top.length}
-                    aria-expanded={isOpen}
-                    className="flex w-full items-center gap-2 text-left disabled:cursor-default"
-                  >
-                    <UserAvatar
-                      name={name}
-                      userId={g.userId}
-                      avatarAt={g.avatarAt}
-                      className="h-6 w-6 text-[10px]"
-                    />
-                    <span className="min-w-0 flex-1 truncate text-xs text-fg-secondary">
-                      {name}
-                    </span>
-                    <span className="text-[10px] font-mono text-fg-muted">
-                      {t("host.processCount", { n: g.processes })}
-                    </span>
-                  </button>
+                  {/* The hover card sits on the name row only: over the whole
+                      tile it stacked on the CPU bar's own help tip. */}
+                  <Tip raw={userTip(g)} block>
+                    <button
+                      type="button"
+                      onClick={() => setOpen(isOpen ? null : g.key)}
+                      disabled={!g.top.length}
+                      aria-expanded={isOpen}
+                      className="flex w-full items-center gap-2 text-left disabled:cursor-default"
+                    >
+                      <UserAvatar
+                        name={name}
+                        userId={g.userId}
+                        avatarAt={g.avatarAt}
+                        className="h-6 w-6 text-[10px]"
+                      />
+                      <span className="min-w-0 flex-1 truncate text-xs text-fg-secondary">
+                        {name}
+                      </span>
+                      <span className="text-[10px] font-mono text-fg-muted">
+                        {t("host.processCount", { n: g.processes })}
+                      </span>
+                    </button>
+                  </Tip>
                   <HealthBar label="CPU" value={g.cpu} tip={t("host.cpuHelp")} />
                   <HealthBar label={`RAM · ${formatBytes(g.memory)}`} value={g.memoryPercent} />
                   {isOpen && (

client/src/components/health/__tests__/HostHealth.test.tsx

@@ -7,7 +7,8 @@
  * rate and each network interface, the CPU / memory history with its range
  * switch (`GET /api/host/history`), and the busiest processes with who each
  * counts for, the processes of no user in a short list of their own, and
- * each user's live CPU / RAM as a tile (their busiest processes on click);
+ * each user's live CPU / RAM as a tile (their busiest processes on click; on
+ * hover, for staff, their role and $ spent today);
  * off Linux the cards it can never fill are left out.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
@@ -69,8 +70,10 @@ const stats: HostStats = {
 const api = vi.hoisted(() => ({
   host: { stats: vi.fn(), history: vi.fn() },
   me: { avatarUrl: () => null },
-  users: { avatarUrl: () => null },
+  users: { avatarUrl: () => null, list: vi.fn() },
 }));
+const perms = vi.hoisted(() => ({ seesAll: true, local: true, isAdmin: true }));
+vi.mock("../../AuthGate", () => ({ usePermissions: () => perms }));
 vi.mock("../../../lib/api", async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>();
   return { ...actual, api };
@@ -105,6 +108,7 @@ const full: HostStats = {
 
 beforeEach(() => {
   vi.clearAllMocks();
+  Object.assign(perms, { seesAll: true, local: true, isAdmin: true });
   api.host.stats.mockResolvedValue(full);
   api.host.history.mockResolvedValue({
     range: "1h",
@@ -182,6 +186,50 @@ describe("HostHealth", () => {
     expect(within(tile).getByText("claude")).toBeTruthy();
   });
 
+  it("names the role and today's spend when a user tile is hovered", async () => {
+    Object.assign(perms, { local: false });
+    api.users.list.mockResolvedValue({
+      users: [
+        {
+          id: 2,
+          username: "mia",
+          role: "developer",
+          disabled: false,
+          workspaces: 2,
+          sessions: 5,
+          today: { cost: 1.5, tokens: 12000 },
+          last7d: { cost: 0, tokens: 0 },
+          last30d: { cost: 0, tokens: 0 },
+          lastLoginAt: null,
+        },
+      ],
+    });
+    render(<Tab />);
+    const tile = await screen.findByTestId("server-user");
+    // The card exists only once the users list has arrived.
+    const nameRow = () => within(tile).getByRole("button").parentElement!;
+    const tip = await vi.waitFor(() => {
+      fireEvent.mouseEnter(nameRow());
+      return screen.getByText(/Role: Developer/);
+    });
+    expect(tip.textContent).not.toContain("Login");
+    expect(tip.textContent).toMatch(/Today: \$1\.5/);
+    expect(tip.textContent).toContain("2 workspaces · 5 sessions");
+    // Only the name row carries it: the CPU bar keeps its own help tip alone.
+    fireEvent.mouseLeave(within(tile).getByRole("button").parentElement!);
+    fireEvent.mouseEnter(within(tile).getByRole("meter", { name: "CPU" }));
+    expect(screen.queryByText(/Role: Developer/)).toBeNull();
+  });
+
+  it("gives a developer no hover card, without reading the users list", async () => {
+    Object.assign(perms, { seesAll: false, local: false, isAdmin: false });
+    render(<Tab />);
+    const tile = await screen.findByTestId("server-user");
+    fireEvent.mouseEnter(within(tile).getByRole("button").parentElement!);
+    expect(screen.queryByText(/Today:/)).toBeNull();
+    expect(api.users.list).not.toHaveBeenCalled();
+  });
+
   it("leaves out what Windows cannot report instead of empty cards", async () => {
     api.host.stats.mockResolvedValue({
       ...stats,

client/src/components/lanes/FileExplorer.tsx

@@ -91,6 +91,7 @@ import {
   type FsPlace,
   type GitSource,
   isHomePlace,
+  newUploadId,
 } from "../../lib/api";
 import type { Lane } from "../../lib/types";
 import { useDialog } from "../../hooks/useDialog";
@@ -529,7 +530,13 @@ export function FileBrowser({
       await fn();
       if (done) toast.success(done);
     } catch (e) {
-      toast.error(errCode(e) === "EUPGRADE" ? t("fx.needsUpgrade") : errText(e));
+      toast.error(
+        errCode(e) === "EUPGRADE"
+          ? t("fx.needsUpgrade")
+          : errCode(e) === "ESECRET"
+            ? t("fx.secret")
+            : errText(e)
+      );
     } finally {
       setBusy(false);
       changed();
@@ -682,13 +689,21 @@ export function FileBrowser({
     // false once the server says a batch cannot be written here (an old helper).
     let batchable = true;
     const show = (name: string, extra = 0) => job.update({ name, done, sent: sent + extra });
+    const onWait = (waiting: boolean) => job.update({ waiting });
     /** One file; false = the user cancelled. */
     const one = async ({ file, rel }: { file: File; rel: string }) => {
       if (signal.aborted) return false;
       const dest = join(dir, rel);
       show(rel);
+      // One id for every attempt: a retry with another `conflict` reuses the staged bytes.
+      const upload = newUploadId();
       const send = (c: FsConflict) =>
-        api.files.upload(place, dest, file, c, (n) => show(rel, n), signal);
+        api.files.uploadStaged(place, dest, file, c, {
+          upload,
+          onProgress: (n) => show(rel, n),
+          onWait,
+          signal,
+        });
       try {
         const r = await send(forAll ?? "fail").catch(async (e) => {
           if (errCode(e) !== "EEXISTS") throw e;
@@ -701,6 +716,9 @@ export function FileBrowser({
       } catch (e) {
         if (errCode(e) === "ECANCEL" || errCode(e) === "EABORT") return false;
         toast.error(t("fx.uploadFailed", { name: rel, message: errText(e) }));
+      } finally {
+        onWait(false);
+        void api.files.dropUpload(place, upload);
       }
       sent += file.size;
       done++;
@@ -720,6 +738,7 @@ export function FileBrowser({
         return a.choice;
       };
       if (signal.aborted) return "cancel";
+      const upload = newUploadId();
       try {
         const c = await api.files.uploadCheck(
           place,
@@ -733,7 +752,12 @@ export function FileBrowser({
         let policy = await choose(c.taken);
         if (!policy) return "cancel";
         const send = (p: FsConflict) =>
-          api.files.uploadBatch(place, dir, b, p, (n) => show(label, n), signal);
+          api.files.uploadBatchStaged(place, dir, b, p, {
+            upload,
+            onProgress: (n) => show(label, n),
+            onWait,
+            signal,
+          });
         const r = await send(policy).catch(async (e) => {
           // Taken meanwhile: ask about those, then once more.
           if (errCode(e) !== "EEXISTS") throw e;
@@ -752,6 +776,9 @@ export function FileBrowser({
           return "fallback";
         }
         toast.error(t("fx.uploadFailed", { name: label, message: errText(e) }));
+      } finally {
+        onWait(false);
+        void api.files.dropUpload(place, upload);
       }
       sent += size;
       done += b.length;
@@ -1693,7 +1720,6 @@ export function FileBrowser({
             <span className="ml-auto hidden md:inline">{t("fx.dropHint")}</span>
           </div>
         )}
-
       </div>
 
       {ctx.menu && (

client/src/components/lanes/LaneChangesPanel.tsx

@@ -489,8 +489,9 @@ function FileActions({
           title={t("changes.discardConfirm")}
           disabled={busy}
           onClick={() => onAct("discard", f.path, true)}
-          className={`${HUNK_CHIP} border-status-danger bg-status-danger/20 text-status-danger`}
+          className="flex shrink-0 items-center gap-1 rounded bg-status-danger/10 px-1 py-0.5 text-[11px] leading-3 text-status-danger hover:bg-status-danger/20 disabled:opacity-40"
         >
+          <Trash2 className="h-3 w-3" />
           {t("changes.discardShortConfirm")}
         </button>
       ) : (

client/src/components/lanes/LaneGitBar.tsx

@@ -57,6 +57,7 @@ import { isSubmitEnter } from "../../lib/keys";
 import type { LaneGitFacts, LaneWorktree } from "../../lib/types";
 import { restoreShelf } from "./LaneShelves";
 import { BranchesButton } from "./git/BranchesButton";
+import { Select } from "../Select";
 
 type Action =
   "fetch" | "pull" | "push" | "switch" | "branch-create" | "branch-delete" | "merge" | "publish";
@@ -526,33 +527,32 @@ export function LaneGitBar({
 
       {switching && (
         <div className="flex flex-wrap items-center gap-1.5">
-          <select
-            aria-label={t("gitBar.switchLabel")}
-            value={picked}
-            disabled={!!busy}
-            onChange={(e) => setPicked(e.target.value)}
-            className="select min-w-[8rem] flex-1 !rounded !py-0.5 !pl-2 !pr-6 font-mono !text-[11px]"
-          >
-            <option value="">{t("gitBar.switchLabel")}</option>
-            {(branches || []).map((b) => {
-              const held = heldBy.get(b);
-              return (
-                <option key={b} value={b}>
-                  {b}
-                  {b === git.branch ? ` — ${t("gitBar.switchCurrent")}` : held ? ` — ${held}` : ""}
-                </option>
-              );
-            })}
-            {remoteBranches.length > 0 && (
-              <optgroup label={t("gitBar.remoteBranches")}>
-                {remoteBranches.map((b) => (
-                  <option key={`remote:${b}`} value={b}>
-                    {b}
-                  </option>
-                ))}
-              </optgroup>
-            )}
-          </select>
+          {/* A combobox once the list is long (Select's search box, #88):
+              type to narrow the local and remote branches. */}
+          <div className="min-w-[8rem] flex-1 font-mono">
+            <Select
+              label={t("gitBar.switchLabel")}
+              searchLabel={t("gitBar.branchSearch")}
+              searchable
+              value={picked}
+              disabled={!!busy}
+              onChange={setPicked}
+              options={[
+                { value: "", label: t("gitBar.switchLabel") },
+                ...(branches || []).map((b) => {
+                  const held = heldBy.get(b);
+                  const note =
+                    b === git.branch ? ` — ${t("gitBar.switchCurrent")}` : held ? ` — ${held}` : "";
+                  return { value: b, label: `${b}${note}` };
+                }),
+                ...remoteBranches.map((b) => ({
+                  value: b,
+                  label: b,
+                  group: t("gitBar.remoteBranches"),
+                })),
+              ]}
+            />
+          </div>
           <Btn
             label={t("gitBar.switchApply")}
             busy={busy === "switch"}

client/src/components/lanes/LaneGitHeader.tsx

@@ -373,12 +373,17 @@ export function LaneGitHeader({
         className="flex min-w-0 flex-1 items-baseline gap-1.5 font-mono text-[11px]"
         title={`${git.head} ${git.subject}`}
       >
-        <span className="flex shrink-0 items-center gap-1 self-center font-semibold text-fg-primary">
-          <GitBranch className="h-3 w-3 text-fg-muted" />
-          {git.branch}
+        {/* A long branch name truncates too (after the subject has gone),
+            or it overflowed onto the head and the action icons. */}
+        <span
+          className="flex min-w-[5rem] items-center gap-1 self-center font-semibold text-fg-primary"
+          title={git.branch}
+        >
+          <GitBranch className="h-3 w-3 shrink-0 text-fg-muted" />
+          <span className="truncate">{git.branch}</span>
         </span>
         <span className="shrink-0 text-fg-muted">{git.head}</span>
-        <span className="min-w-0 truncate text-fg-muted">{git.subject}</span>
+        <span className="min-w-0 shrink-[999] truncate text-fg-muted">{git.subject}</span>
       </div>
     </>
   );

client/src/components/lanes/SessionReplay.tsx

@@ -145,7 +145,7 @@ export function SessionReplay({
       {livePane ? (
         <div
           data-testid="session-replay-live"
-          className="mx-auto flex w-full max-w-3xl items-center gap-2 rounded-2xl border border-border p-3 text-xs text-fg-secondary"
+          className="mx-auto flex w-full max-w-5xl items-center gap-2 rounded-2xl border border-border p-3 text-xs text-fg-secondary"
         >
           <span className="min-w-0 flex-1">{t("replay.live")}</span>
           <button
@@ -160,7 +160,7 @@ export function SessionReplay({
       ) : session && !resumable ? (
         <div
           data-testid="session-replay-no-resume"
-          className="mx-auto flex w-full max-w-3xl items-center gap-2 rounded-2xl border border-border p-3 text-xs text-fg-secondary"
+          className="mx-auto flex w-full max-w-5xl items-center gap-2 rounded-2xl border border-border p-3 text-xs text-fg-secondary"
         >
           <span className="min-w-0 flex-1">{t("replay.noResume", { tool })}</span>
           <button
@@ -172,7 +172,7 @@ export function SessionReplay({
           </button>
         </div>
       ) : (
-        <div className="mx-auto w-full max-w-3xl rounded-2xl border border-border p-2 shadow-sm transition-colors focus-within:border-accent/50">
+        <div className="mx-auto w-full max-w-5xl rounded-2xl border border-border p-2 shadow-sm transition-colors focus-within:border-accent/50">
           <PromptEditor
             bare
             images={images}

client/src/components/lanes/UrlPreview.tsx

@@ -0,0 +1,180 @@
+/**
+ * @file UrlPreview.tsx
+ * @description The session panel's Preview tab: a web page (a lane's dev
+ * server, mostly) shown beside the console. One bar — address, Reload, Open
+ * in a browser tab — and, before anything is open, the workspace's own ports
+ * as one-click chips. The page runs in an `<iframe src>` on ITS OWN origin:
+ * `normalizePreviewUrl` refuses the dashboard's origin and anything but
+ * http(s), and the sandbox leaves out top navigation so a page cannot move
+ * the dashboard away. A site that forbids framing (most login pages) shows
+ * blank or as the browser's broken-page icon; that is the browser's rule and
+ * cannot be read from here, so any page not on this machine gets a strip
+ * saying so with the Open button beside it. The
+ * last address is remembered per workspace in localStorage (a viewer
+ * convenience, never the server's).
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { ExternalLink, Globe, RotateCw } from "lucide-react";
+import { isLoopbackUrl, normalizePreviewUrl } from "../../lib/openInPreview";
+import { isSubmitEnter } from "../../lib/keys";
+import { toast } from "../../lib/toast";
+
+const KEY = (laneId: number) => `agenthub.preview.url.${laneId}`;
+
+function readSaved(laneId: number): string {
+  try {
+    return window.localStorage.getItem(KEY(laneId)) ?? "";
+  } catch {
+    return "";
+  }
+}
+
+/** The frame's sandbox: everything a web app needs, minus moving the
+ *  dashboard (`allow-top-navigation*`). `allow-same-origin` is the PAGE's
+ *  own origin — never the dashboard's, which `normalizePreviewUrl` refuses. */
+const FRAME_SANDBOX =
+  "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-modals allow-downloads";
+
+export function UrlPreview({
+  laneId,
+  ports,
+  request,
+}: {
+  laneId: number;
+  /** The lane's bound ports, by name — the chips of the empty state. */
+  ports: Record<string, number>;
+  /** A link asked for this page (`openInPreview`); a new nonce re-opens it. */
+  request: { url: string; nonce: number } | null;
+}) {
+  const { t } = useTranslation("lanes");
+  const [url, setUrl] = useState(() => readSaved(laneId));
+  const [draft, setDraft] = useState(url);
+  const [reload, setReload] = useState(0);
+
+  // Another workspace: its own last page.
+  useEffect(() => {
+    const saved = readSaved(laneId);
+    setUrl(saved);
+    setDraft(saved);
+  }, [laneId]);
+
+  useEffect(() => {
+    if (request) go(request.url);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- keyed on the nonce
+  }, [request?.nonce]);
+
+  function go(raw: string) {
+    const next = normalizePreviewUrl(raw);
+    if (!next) {
+      toast.error(t("preview.badUrl"));
+      return;
+    }
+    setUrl(next);
+    setDraft(next);
+    setReload((n) => n + 1);
+    try {
+      window.localStorage.setItem(KEY(laneId), next);
+    } catch {
+      /* disabled storage: the tab just forgets between visits */
+    }
+  }
+
+  const openTab = () => url && window.open(url, "_blank", "noopener,noreferrer");
+  const portList = Object.entries(ports ?? {}).filter(([, p]) => Number.isInteger(p) && p > 0);
+  const btn =
+    "flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-fg-muted transition-colors hover:bg-surface-4 hover:text-fg-primary disabled:opacity-40 disabled:hover:bg-transparent";
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col" data-testid="url-preview">
+      <div className="flex shrink-0 items-center gap-1 border-b border-border px-2 py-1.5">
+        <input
+          value={draft}
+          onChange={(e) => setDraft(e.target.value)}
+          onKeyDown={(e) => {
+            if (isSubmitEnter(e)) {
+              e.preventDefault();
+              go(draft);
+            }
+          }}
+          placeholder="localhost:3000"
+          aria-label={t("preview.address")}
+          spellCheck={false}
+          className="min-w-0 flex-1 rounded border border-border bg-surface-1 px-2 py-1 font-mono text-[11px] text-fg-primary"
+        />
+        <button
+          type="button"
+          className={btn}
+          disabled={!url}
+          onClick={() => setReload((n) => n + 1)}
+          title={t("preview.reload")}
+          aria-label={t("preview.reload")}
+        >
+          <RotateCw className="h-3.5 w-3.5" />
+        </button>
+        <button
+          type="button"
+          className={btn}
+          disabled={!url}
+          onClick={openTab}
+          title={t("preview.openTab")}
+          aria-label={t("preview.openTab")}
+        >
+          <ExternalLink className="h-3.5 w-3.5" />
+        </button>
+      </div>
+      {url && !isLoopbackUrl(url) && (
+        // An outside site: most refuse to be framed, and a refusal cannot be
+        // detected from here — so say it, with the way out beside it.
+        <div
+          data-testid="url-preview-blocked-hint"
+          className="flex shrink-0 items-center gap-2 border-b border-border bg-surface-2 px-2 py-1.5 text-[11px] text-fg-secondary"
+        >
+          <span className="min-w-0 flex-1">{t("preview.blockedHint")}</span>
+          <button
+            type="button"
+            onClick={openTab}
+            className="flex shrink-0 items-center gap-1 rounded-md px-1.5 py-0.5 font-medium text-accent hover:bg-surface-4"
+          >
+            <ExternalLink className="h-3 w-3" />
+            {t("preview.openTabShort")}
+          </button>
+        </div>
+      )}
+      {url ? (
+        <iframe
+          key={`${url}#${reload}`}
+          src={url}
+          title={t("preview.title")}
+          sandbox={FRAME_SANDBOX}
+          referrerPolicy="no-referrer"
+          className="min-h-0 w-full flex-1 border-0 bg-white"
+          data-testid="url-preview-frame"
+        />
+      ) : (
+        <div className="flex flex-1 flex-col items-center justify-center gap-3 px-6 text-center">
+          <Globe className="h-6 w-6 text-fg-muted" />
+          <p className="text-xs text-fg-secondary">{t("preview.empty")}</p>
+          {portList.length > 0 && (
+            <div className="flex flex-wrap justify-center gap-1.5">
+              {portList.map(([name, port]) => (
+                <button
+                  key={name}
+                  type="button"
+                  onClick={() => go(`localhost:${port}`)}
+                  title={name}
+                  className="rounded-full border border-border px-2.5 py-0.5 font-mono text-[11px] text-fg-secondary transition-colors hover:bg-surface-4 hover:text-fg-primary"
+                >
+                  localhost:{port}
+                </button>
+              ))}
+            </div>
+          )}
+          <p className="text-[11px] text-fg-muted">{t("preview.loginHint")}</p>
+        </div>
+      )}
+    </div>
+  );
+}

client/src/components/lanes/__tests__/FileExplorer.test.tsx

@@ -31,6 +31,10 @@ vi.mock("../../../lib/api", () => ({
   gitTarget: (lane: number, session?: string | null, source?: number | null) =>
     source ? { lane, source } : session ? { lane, session } : lane,
   isHomePlace: (p: unknown) => typeof p === "object" && p !== null && "home" in p,
+  newUploadId: (() => {
+    let n = 0;
+    return () => `upload-id-${String(++n).padStart(8, "0")}`;
+  })(),
   api: {
     lanes: {
       list: vi.fn(),
@@ -52,8 +56,9 @@ vi.mock("../../../lib/api", () => ({
       allTrash: vi.fn(),
       restore: vi.fn(),
       purge: vi.fn(),
-      upload: vi.fn(),
-      uploadBatch: vi.fn(),
+      uploadStaged: vi.fn(),
+      uploadBatchStaged: vi.fn(),
+      dropUpload: vi.fn(async () => null),
       uploadCheck: vi.fn(),
       zipUrl: (t: number, ps: string[]) => `/api/lanes/${t}/fs/zip?p=${ps.join("&p=")}`,
     },
@@ -236,7 +241,7 @@ describe("FileExplorer", () => {
   });
 
   it("asks about a taken name on upload, and sends the choice", async () => {
-    vi.mocked(api.files.upload)
+    vi.mocked(api.files.uploadStaged)
       .mockRejectedValueOnce(
         Object.assign(new Error("taken"), { code: "EEXISTS", names: ["a.txt"] })
       )
@@ -249,20 +254,24 @@ describe("FileExplorer", () => {
     const ask = await screen.findByTestId("fx-conflict");
     await user.click(within(ask).getByRole("button", { name: "Keep both" }));
     await waitFor(() =>
-      expect(api.files.upload).toHaveBeenLastCalledWith(
+      expect(api.files.uploadStaged).toHaveBeenLastCalledWith(
         1,
         "a.txt",
         file,
         "keep",
-        expect.any(Function),
-        expect.any(AbortSignal)
+        expect.objectContaining({ upload: expect.any(String), signal: expect.any(AbortSignal) })
       )
     );
+    // The retry names the SAME upload, so the staged bytes are not sent again,
+    // and the staged upload is dropped once answered.
+    const [first, second] = vi.mocked(api.files.uploadStaged).mock.calls.map((c) => c[4].upload);
+    expect(second).toBe(first);
+    await waitFor(() => expect(api.files.dropUpload).toHaveBeenCalledWith(1, first));
   });
 
   it("sends many small files as one batch, asking once about every taken name", async () => {
     vi.mocked(api.files.uploadCheck).mockResolvedValue({ taken: ["a.txt", "b.txt"], batch: true });
-    vi.mocked(api.files.uploadBatch).mockResolvedValue({ saved: 3, skipped: 0, paths: [] });
+    vi.mocked(api.files.uploadBatchStaged).mockResolvedValue({ saved: 3, skipped: 0, paths: [] });
     const user = userEvent.setup();
     open();
     await screen.findByText("a.txt");
@@ -271,33 +280,32 @@ describe("FileExplorer", () => {
     const ask = await screen.findByTestId("fx-conflict");
     await user.click(within(ask).getByRole("button", { name: "Replace" }));
     await waitFor(() =>
-      expect(api.files.uploadBatch).toHaveBeenCalledWith(
+      expect(api.files.uploadBatchStaged).toHaveBeenCalledWith(
         1,
         "",
         files.map((file) => ({ file, rel: file.name })),
         "replace",
-        expect.any(Function),
-        expect.any(AbortSignal)
+        expect.objectContaining({ upload: expect.any(String), signal: expect.any(AbortSignal) })
       )
     );
     expect(api.files.uploadCheck).toHaveBeenCalledWith(1, "", ["a.txt", "b.txt", "c.txt"]);
-    expect(api.files.upload).not.toHaveBeenCalled();
+    expect(api.files.uploadStaged).not.toHaveBeenCalled();
   });
 
   it("falls back to one request per file when the server cannot take a batch", async () => {
     vi.mocked(api.files.uploadCheck).mockResolvedValue({ taken: [], batch: false });
-    vi.mocked(api.files.upload).mockResolvedValue({ path: "x" });
+    vi.mocked(api.files.uploadStaged).mockResolvedValue({ path: "x" });
     const user = userEvent.setup();
     open();
     await screen.findByText("a.txt");
     const files = ["x.txt", "y.txt"].map((n) => new File(["hi"], n));
     await user.upload(screen.getByTestId("fx-upload-files"), files);
-    await waitFor(() => expect(api.files.upload).toHaveBeenCalledTimes(2));
-    expect(api.files.uploadBatch).not.toHaveBeenCalled();
+    await waitFor(() => expect(api.files.uploadStaged).toHaveBeenCalledTimes(2));
+    expect(api.files.uploadBatchStaged).not.toHaveBeenCalled();
   });
 
   it("leaves a picked repo's .git out of a folder upload, with one notice", async () => {
-    vi.mocked(api.files.upload).mockResolvedValue({ path: "x" });
+    vi.mocked(api.files.uploadStaged).mockResolvedValue({ path: "x" });
     open();
     await screen.findByText("a.txt");
     const mk = (rel: string) => {
@@ -307,8 +315,8 @@ describe("FileExplorer", () => {
     };
     const files = ["repo/.git/HEAD", "repo/.git/objects/d4/ab", "repo/src/a.js"].map(mk);
     fireEvent.change(screen.getByTestId("fx-upload-folder"), { target: { files } });
-    await waitFor(() => expect(api.files.upload).toHaveBeenCalledTimes(1));
-    expect(vi.mocked(api.files.upload).mock.calls[0]![1]).toBe("repo/src/a.js");
+    await waitFor(() => expect(api.files.uploadStaged).toHaveBeenCalledTimes(1));
+    expect(vi.mocked(api.files.uploadStaged).mock.calls[0]![1]).toBe("repo/src/a.js");
     expect(toast.info).toHaveBeenCalledTimes(1);
     expect(toast.error).not.toHaveBeenCalled();
   });
@@ -320,7 +328,7 @@ describe("FileExplorer", () => {
     Object.defineProperty(big, "size", { value: 600 * 1024 * 1024 });
     fireEvent.change(screen.getByTestId("fx-upload-files"), { target: { files: [big] } });
     await waitFor(() => expect(toast.error).toHaveBeenCalled());
-    expect(api.files.upload).not.toHaveBeenCalled();
+    expect(api.files.uploadStaged).not.toHaveBeenCalled();
   });
 
   it("restores from the Trash", async () => {

client/src/components/lanes/__tests__/LaneChangesPanel.test.tsx

@@ -171,21 +171,23 @@ beforeEach(() => {
   vi.mocked(h.commit).mockReset().mockResolvedValue({ available: false });
   vi.mocked(h.sequence).mockReset().mockResolvedValue({ available: true, active: false });
   vi.mocked(h.pick).mockReset();
-  vi.mocked(h.pickPlan).mockReset().mockImplementation(async (_t, op, shas) => ({
-    available: true,
-    op,
-    commits: shas.map((sha) => ({
-      sha,
-      short: sha.slice(0, 7),
-      subject: "feat: the commit",
-      author: "t",
-      date: "2026-09-22T01:00:00Z",
-    })),
-    branch: "feat/thing",
-    clean: true,
-    repoRoot: true,
-    busy: false,
-  }));
+  vi.mocked(h.pickPlan)
+    .mockReset()
+    .mockImplementation(async (_t, op, shas) => ({
+      available: true,
+      op,
+      commits: shas.map((sha) => ({
+        sha,
+        short: sha.slice(0, 7),
+        subject: "feat: the commit",
+        author: "t",
+        date: "2026-09-22T01:00:00Z",
+      })),
+      branch: "feat/thing",
+      clean: true,
+      repoRoot: true,
+      busy: false,
+    }));
   vi.mocked(h.fileHistory)
     .mockReset()
     .mockResolvedValue({
@@ -538,7 +540,8 @@ describe("LaneChangesPanel", () => {
     await screen.findByTitle("only-on-thing.ts");
 
     await user.click(screen.getByRole("button", { name: /^Branch$/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "other");
+    await user.click(await screen.findByRole("button", { name: "Switch branch…" }));
+    await user.click(screen.getByRole("option", { name: "other" }));
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
 
     await waitFor(() => expect(screen.getByTestId("lane-git")).toHaveTextContent("other"));
@@ -1344,9 +1347,7 @@ describe("LaneChangesPanel", () => {
       await user.click(within(await commitMenu(user)).getByText("Cherry-pick onto feat/thing"));
       await user.click(await screen.findByTestId("pick-confirm"));
       await waitFor(() =>
-        expect(api.lanes.gitHistory.pick).toHaveBeenCalledWith(7, "cherry-pick", [
-          "a".repeat(40),
-        ])
+        expect(api.lanes.gitHistory.pick).toHaveBeenCalledWith(7, "cherry-pick", ["a".repeat(40)])
       );
     });
 

client/src/components/lanes/__tests__/LaneGitBar.test.tsx

@@ -13,13 +13,22 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { LaneGitBar } from "../LaneGitBar";
 import { api } from "../../../lib/api";
 import { confirmDialog } from "../../../lib/confirm";
 import type { LaneGitFacts } from "../../../lib/types";
 
+/** Picks `name` in the branch switcher — a Select combobox (#88). */
+async function pickBranch(user: ReturnType<typeof userEvent.setup>, name: string) {
+  await user.click(await screen.findByRole("button", { name: "Switch branch…" }));
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  await user.click(
+    within(screen.getByRole("listbox")).getByRole("option", { name: new RegExp(`^${esc}( —|$)`) })
+  );
+}
+
 // A merge asks through the themed confirm (its host lives in App): yes.
 vi.mock("../../../lib/confirm", () => ({ confirmDialog: vi.fn(async () => true) }));
 vi.mock("../../../lib/api", () => ({
@@ -210,7 +219,7 @@ describe("LaneGitBar", () => {
 
     await user.click(screen.getByRole("button", { name: /Branch/ }));
     await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(3));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
     // Nothing is sent before the user picks what happens to the changes.
     expect(api.lanes.gitAction).not.toHaveBeenCalled();
@@ -235,7 +244,7 @@ describe("LaneGitBar", () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
     await user.click(screen.getByRole("button", { name: "Bring my changes" }));
     expect(await screen.findByTestId("lane-git-carry-conflicts")).toHaveTextContent(
@@ -258,7 +267,7 @@ describe("LaneGitBar", () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
     await user.click(screen.getByRole("button", { name: "Shelve and switch" }));
     await waitFor(() =>
@@ -291,7 +300,7 @@ describe("LaneGitBar", () => {
     const onChanged = vi.fn();
     render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={onChanged} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
     await waitFor(() =>
       expect(api.lanes.gitAction).toHaveBeenLastCalledWith(3, "unshelve", { sha: "abc1234def" })
@@ -319,8 +328,8 @@ describe("LaneGitBar", () => {
     render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
 
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    const select = await screen.findByLabelText("Switch branch…");
-    await user.selectOptions(select, "development");
+    await screen.findByRole("button", { name: "Switch branch…" });
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
 
     await waitFor(() =>
@@ -332,11 +341,42 @@ describe("LaneGitBar", () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Switch branch" }));
     await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledTimes(2));
   });
 
+  it("opens the branch switcher as a combobox: type to narrow, Enter picks (#88)", async () => {
+    vi.mocked(api.lanes.gitBranches).mockResolvedValue({
+      available: true,
+      branches: ["development", "feat/campaign-pause", "fix/campaign-step", "main"],
+      remotes: ["origin/feat/campaign-statistic", "origin/feature/thienpt/unit_test"],
+      current: "development",
+      worktrees: [],
+    });
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    const trigger = await screen.findByRole("button", { name: "Switch branch…" });
+    await user.click(trigger);
+    const search = screen.getByRole("combobox", { name: "Search branches…" });
+    expect(search).toHaveFocus();
+    await user.keyboard("CAMPAIGN");
+    expect(screen.getAllByRole("option").map((o) => o.textContent)).toEqual([
+      "feat/campaign-pause",
+      "fix/campaign-step",
+      "origin/feat/campaign-statistic",
+    ]);
+    await user.keyboard("{Enter}");
+    expect(trigger).toHaveTextContent("feat/campaign-pause");
+    await user.click(screen.getByRole("button", { name: "Switch branch" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "switch", {
+        branch: "feat/campaign-pause",
+      })
+    );
+  });
+
   it("lists branches only the remote has, switches to one, and re-reads the list after a fetch", async () => {
     vi.mocked(api.lanes.gitBranches).mockResolvedValue({
       available: true,
@@ -355,11 +395,12 @@ describe("LaneGitBar", () => {
       />
     );
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    const select = await screen.findByLabelText("Switch branch…");
+    await user.click(await screen.findByRole("button", { name: "Switch branch…" }));
     expect(
-      screen.getByRole("group", { name: "On the remote — switching creates the local branch" })
+      screen.getByText("On the remote — switching creates the local branch")
     ).toBeInTheDocument();
-    await user.selectOptions(select, "origin/feat/new");
+    await user.keyboard("{Escape}");
+    await pickBranch(user, "origin/feat/new");
     // Not a local branch yet: nothing to delete, no worktree to start on it.
     expect(screen.getByRole("button", { name: "Delete" })).toBeDisabled();
     expect(screen.getByRole("button", { name: /New workspace here/ })).toBeDisabled();
@@ -395,7 +436,7 @@ describe("LaneGitBar", () => {
       })
     );
 
-    await user.selectOptions(screen.getByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "New workspace here" }));
     expect(onNewLane).toHaveBeenCalledWith("development");
   });
@@ -413,18 +454,18 @@ describe("LaneGitBar", () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    const select = await screen.findByLabelText("Switch branch…");
+    await screen.findByRole("button", { name: "Switch branch…" });
     const newLane = () => screen.getByRole("button", { name: "New workspace here" });
 
     // This lane's own branch: its worktree is this lane.
-    await user.selectOptions(select, "feat/thing");
+    await pickBranch(user, "feat/thing");
     expect(newLane()).toBeDisabled();
     // Held by another worktree: git allows one worktree per branch (EBRANCHBUSY).
-    await user.selectOptions(select, "development");
+    await pickBranch(user, "development");
     expect(newLane()).toBeDisabled();
     expect(newLane()).toHaveAttribute("title", expect.stringContaining("/repo/dev"));
 
-    await user.selectOptions(select, "feat/free");
+    await pickBranch(user, "feat/free");
     expect(newLane()).toBeEnabled();
   });
 
@@ -443,13 +484,15 @@ describe("LaneGitBar", () => {
     const user = userEvent.setup();
     const { rerender } = render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
 
     rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} />);
     expect(screen.queryByLabelText("Switch branch…")).toBeNull();
     await user.click(screen.getByRole("button", { name: /Branch/ }));
     await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
-    expect(await screen.findByLabelText("Switch branch…")).toHaveValue("");
+    expect(await screen.findByRole("button", { name: "Switch branch…" })).toHaveTextContent(
+      "Switch branch…"
+    );
   });
 
   it("sends one branch-create for a double Enter", async () => {
@@ -476,7 +519,7 @@ describe("LaneGitBar", () => {
 
     rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    const select = await screen.findByLabelText("Switch branch…");
+    await screen.findByRole("button", { name: "Switch branch…" });
     await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
     // Lane 3's answer lands late: its worktree held `development`.
     resolveOld({
@@ -485,7 +528,7 @@ describe("LaneGitBar", () => {
       current: "feat/thing",
       worktrees: [{ path: "/repo/dev", branch: "development" }],
     });
-    await user.selectOptions(select, "development");
+    await pickBranch(user, "development");
     const newLane = screen.getByRole("button", { name: "New workspace here" });
     expect(newLane).toBeEnabled();
     expect(newLane).not.toHaveAttribute("title", expect.stringContaining("/repo/dev"));
@@ -572,7 +615,7 @@ describe("merge (issue #45)", () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
     await user.click(screen.getByRole("button", { name: /Branch/ }));
-    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await pickBranch(user, "development");
     await user.click(screen.getByRole("button", { name: "Merge into current" }));
     await waitFor(() =>
       expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge", { branch: "development" })

client/src/components/lanes/__tests__/UrlPreview.test.tsx

@@ -0,0 +1,59 @@
+/**
+ * @file UrlPreview.test.tsx
+ * @description The Preview tab: port chips before a page is open, the
+ * address bar opening a page in a sandboxed frame without top navigation,
+ * a link's request opening its page, the dashboard's own origin refused, and
+ * the framing-refusal strip shown for an outside site only.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { beforeEach, describe, expect, it } from "vitest";
+import { fireEvent, render, screen } from "@testing-library/react";
+import "../../../i18n";
+import { UrlPreview } from "../UrlPreview";
+
+beforeEach(() => window.localStorage.clear());
+
+describe("UrlPreview", () => {
+  it("offers the workspace's ports, and a chip opens that page", () => {
+    render(<UrlPreview laneId={1} ports={{ web: 3001 }} request={null} />);
+    fireEvent.click(screen.getByText("localhost:3001"));
+    const frame = screen.getByTestId("url-preview-frame");
+    expect(frame.getAttribute("src")).toBe("http://localhost:3001/");
+    expect(frame.getAttribute("sandbox")).not.toMatch(/top-navigation/);
+    expect(window.localStorage.getItem("agenthub.preview.url.1")).toBe("http://localhost:3001/");
+  });
+
+  it("opens what the address bar names, and refuses the dashboard itself", () => {
+    render(<UrlPreview laneId={2} ports={{}} request={null} />);
+    const input = screen.getByRole("textbox");
+    fireEvent.change(input, { target: { value: window.location.origin + "/settings" } });
+    fireEvent.keyDown(input, { key: "Enter" });
+    expect(screen.queryByTestId("url-preview-frame")).toBeNull();
+    fireEvent.change(input, { target: { value: "127.0.0.1:8080/app" } });
+    fireEvent.keyDown(input, { key: "Enter" });
+    expect(screen.getByTestId("url-preview-frame").getAttribute("src")).toBe(
+      "http://127.0.0.1:8080/app"
+    );
+  });
+
+  it("warns that an outside site may refuse to be framed, never for a local page", () => {
+    render(<UrlPreview laneId={4} ports={{}} request={null} />);
+    const input = screen.getByRole("textbox");
+    fireEvent.change(input, { target: { value: "localhost:3000" } });
+    fireEvent.keyDown(input, { key: "Enter" });
+    expect(screen.queryByTestId("url-preview-blocked-hint")).toBeNull();
+    fireEvent.change(input, { target: { value: "https://youtube.com" } });
+    fireEvent.keyDown(input, { key: "Enter" });
+    expect(screen.getByTestId("url-preview-blocked-hint")).toBeTruthy();
+  });
+
+  it("opens a link's request", () => {
+    render(
+      <UrlPreview laneId={3} ports={{}} request={{ url: "http://localhost:5173/", nonce: 1 }} />
+    );
+    expect(screen.getByTestId("url-preview-frame").getAttribute("src")).toBe(
+      "http://localhost:5173/"
+    );
+  });
+});

client/src/components/run/ChatAddMenu.tsx

@@ -78,7 +78,7 @@ function loadLists(cwd: string): Promise<Lists> {
 }
 
 const PANEL =
-  "absolute w-60 rounded-xl border border-border bg-surface-1 py-1 shadow-lg animate-fade-in";
+  "absolute z-40 w-60 rounded-xl border border-border bg-surface-1 py-1 shadow-lg animate-fade-in";
 /** Room the menu and its tallest submenu (Project files: search + list) need. */
 const MENU_ROOM = 380;
 

client/src/components/run/ConsoleTabs.tsx

@@ -16,8 +16,9 @@
  * keys, Home and End move between tabs (one tab stop, APG). Errors are
  * toasts. The `+` menu opens a new tab in the free slot the server picks
  * (`slot: "auto"`) — a plain shell (`POST /api/lanes/:id/start {shell: true}`)
- * or an installed, enabled AI tool started bare on its default model, no
- * prompt (a prompt, proxy or worktree is still the workspace home's prompt
+ * or an installed, enabled AI tool started bare on its default model and
+ * the account's Session defaults (permission mode, Codex sandbox/approval/
+ * bypass), no prompt (a prompt, proxy or worktree is still the workspace home's prompt
  * box) — plus a link to Settings → Agents. Ten sessions is the server's limit
  * (`MAX_PANE_SLOT`). The bar is the console's only header: Home (the
  * workspace's home) at its left end, `actions` (the single pane's split menus)
@@ -72,6 +73,7 @@ import {
   type GroupsUpdate,
 } from "./PaneGrid";
 import { insertionIndex } from "../../lib/laneOrderStorage";
+import { readCodexDefaults, readDefaultMode } from "../../lib/sessionDefaults";
 import {
   type PaneGroups,
   MAX_PANES,
@@ -140,15 +142,21 @@ export function newTabTools(lane: Lane, aiTools: AiToolsState): string[] {
   ];
 }
 
-/** The start body of a bare tool on its default model, no prompt. Only a
- *  different tool is named, as the home does: the workspace's own keeps
- *  starting even once disabled. */
+/** The start body of a bare tool on its default model, no prompt, in the
+ *  account's Session defaults (Claude's permission mode, Codex's sandbox,
+ *  approval and bypass) — the same ones the workspace home's prompt box starts
+ *  from. Only a different tool is named, as the home does: the workspace's own
+ *  keeps starting even once disabled. */
 export function newTabBody(id: string, lane: Lane, aiTools: AiToolsState) {
   const model = aiTools.byId(id)?.defaultModel;
+  const codex = id === "codex" ? readCodexDefaults() : null;
   return {
     prompt: "",
     ...(id !== lane.tool ? { tool: id } : {}),
     ...(model ? { model } : {}),
+    ...(id === "claude" ? { permissionMode: readDefaultMode() } : {}),
+    ...(codex ? { sandbox: codex.sandbox, approval: codex.approval } : {}),
+    ...(codex?.bypass && aiTools.byId(id)?.bypass ? { bypass: true } : {}),
   };
 }
 

client/src/components/run/PaneChat.tsx

@@ -124,6 +124,11 @@ const isSettable = (m: unknown): m is PermissionMode => MODES.some(([v]) => v ==
 const OUTPUT_FETCH_MS = 1000;
 /** A tool with no known busy line counts as at work this long after its pane last drew. */
 const OUTPUT_BUSY_MS = 2000;
+/** How long Stop stays up after every busy signal dropped: the screen's busy
+ *  line comes and goes while the CLI redraws, and without a hold the button
+ *  flickered between Stop and Send mid-turn. An explicit end (Stop pressed)
+ *  is not held. */
+const BUSY_HOLD_MS = 2500;
 const SIDE_KEY = "agenthub.chat.panelWidth";
 const clampSide = (f: number) => Math.round(Math.min(0.7, Math.max(0.2, f)) * 100) / 100;
 const outlineKey = (sessionId: string) => `agenthub.chat.panel.${sessionId}`;
@@ -140,6 +145,23 @@ const storedSide = () => {
  *  older; every Claude model since (Sonnet/Opus 4.6+, the 5 family) has 1M
  *  (LiteLLM's list, 2026-10). Null for another vendor's model. */
 // ponytail: a fixed rule, not a table; read LiteLLM's max_input_tokens if a new 200K model ships.
+/** `value`, except that a drop to false shows only once it has lasted
+ *  `holdMs`; a change of `release` (Stop pressed) lets it drop at once. */
+export function useHeldTrue(value: boolean, holdMs: number, release: unknown): boolean {
+  const [held, setHeld] = useState(value);
+  const released = useRef(release);
+  useEffect(() => {
+    if (value) return setHeld(true);
+    if (released.current !== release) {
+      released.current = release;
+      return setHeld(false);
+    }
+    const timer = window.setTimeout(() => setHeld(false), holdMs);
+    return () => window.clearTimeout(timer);
+  }, [value, holdMs, release]);
+  return value || held;
+}
+
 export function contextWindow(model: string | null): number | null {
   // A Codex/omp chat reports its own window (ContextMeter's `window`).
   if (!model?.startsWith("claude-")) return null;
@@ -622,13 +644,18 @@ export const PaneChat = memo(function PaneChat({
   const [waiting, setWaiting] = useState(false);
   // Stop presses, for the conversation's live line (issue #74).
   const [stops, setStops] = useState(0);
-  const readWorking = useCallback(
-    () =>
+  // Reads overlap (every throttled transcript change starts one); only the
+  // newest may land, or a slow older answer put back a state already left.
+  const readSeq = useRef(0);
+  const readWorking = useCallback(() => {
+    const seq = ++readSeq.current;
+    return (
       api.agents
         .list({ session_id: sessionId, status: "working" })
         // With session_id the server answers every agent of the session, its
         // status filter ignored: check the status here.
         .then((r) => {
+          if (seq !== readSeq.current) return;
           const main = r.agents.filter((a) => a.type === "main");
           // A fresh start, resume or `/clear` leaves main "working" at an
           // empty prompt (SessionStart's flag) until the first prompt.
@@ -637,9 +664,9 @@ export const PaneChat = memo(function PaneChat({
           );
           setWaiting(main.some((a) => agentAwaitingReason(a) === "notification"));
         })
-        .catch(() => {}),
-    [sessionId]
-  );
+        .catch(() => {})
+    );
+  }, [sessionId]);
   useEffect(() => {
     void readWorking();
   }, [readWorking]);
@@ -689,8 +716,11 @@ export const PaneChat = memo(function PaneChat({
     // another dashboard on the same database, or the socket dropped) would
     // otherwise leave Stop up after the turn ended.
     intervalMs: working || waiting ? 5000 : undefined,
+    // The transcript growing re-reads it too: a hook that reached another
+    // dashboard on the same database sends this one no agent_updated, and
+    // without a poll Stop never showed for a turn the chat calls Thinking….
     match: (msg) =>
-      msg.type === "agent_updated" &&
+      (msg.type === "agent_updated" || msg.type === "transcript_changed") &&
       (msg.data as { session_id?: string } | undefined)?.session_id === sessionId,
   });
 
@@ -711,7 +741,7 @@ export const PaneChat = memo(function PaneChat({
     }, 700);
     return () => window.clearInterval(timer);
   }, [runId, onScreen]);
-  const busy = working || screenBusy;
+  const busy = useHeldTrue(working || screenBusy, BUSY_HOLD_MS, stops);
   const asking = waiting || menu !== null;
   // Gone until the pane redraws: no second press on a stale menu.
   const choose = (index: number) => {
@@ -855,7 +885,7 @@ export const PaneChat = memo(function PaneChat({
           )}
         </div>
         <div className="mx-4">
-          <div className="mx-auto w-full max-w-3xl">
+          <div className="mx-auto w-full max-w-5xl">
             {menu && (
               <PaneMenuCard
                 // A new question starts with its field closed.

client/src/components/run/TerminalView.tsx

@@ -86,10 +86,12 @@ import {
   sameFilesHere,
 } from "../../lib/promptAttach";
 import { attachImeInput } from "../../lib/imeInput";
+import { SCROLL_SPEED, wheelReports, type WheelState } from "../../lib/wheelReports";
 import { nativePasteKey, nativePasteWorks, readNativePaste } from "../../lib/nativePaste";
 import { usePermissions } from "../AuthGate";
 import { TERMINAL_FONTS, readTerminalFont } from "../../lib/terminalFont";
 import { FONT_SIZE_EVENT, readTerminalFontSize } from "../../lib/fontSize";
+import { openInPreview } from "../../lib/openInPreview";
 
 type DropState = "hint" | "paste" | "uploading" | "failed" | "tooBig" | "tooBigLocalPaste";
 
@@ -453,6 +455,8 @@ export const TerminalView = memo(function TerminalView({
         fontWeightBold: 700,
         theme: paletteRef.current,
         screenReaderMode: readFlag(SCREEN_READER_KEY),
+        // xterm's own scrollback scrolls at the same share as the reports below.
+        scrollSensitivity: SCROLL_SPEED,
       });
       termRef.current = term;
       const fit = new FitAddon();
@@ -462,7 +466,10 @@ export const TerminalView = memo(function TerminalView({
       searchRef.current = search;
       term.loadAddon(new ClipboardWithProvider(undefined, clipboardProvider));
       term.loadAddon(
-        new WebLinksAddon((_e, uri) => {
+        new WebLinksAddon((e, uri) => {
+          // A local page opens in the session panel's Preview (one rule
+          // for every link, `lib/openInPreview.ts`); Ctrl/Cmd keeps a tab.
+          if (!e.ctrlKey && !e.metaKey && !e.shiftKey && openInPreview(uri)) return;
           window.open(uri, "_blank", "noopener,noreferrer");
         })
       );
@@ -520,9 +527,38 @@ export const TerminalView = memo(function TerminalView({
       // wheel report itself — psmux scrolls, or hands it to the pane's app.
       // ponytail: at 1;1, which is all psmux reports to the app anyway.
       let ownWheel = false;
+      // Tracked: the reports are this pane's own too — one per
+      // LINES_PER_REPORT rows of travel (lib/wheelReports.ts), where xterm
+      // sends one per event and damps a touchpad ×0.3. SGR, as tmux always
+      // asks for it; at the pointer's cell, with xterm's modifier bits.
+      const wheelState: WheelState = { partial: 0 };
+      const sendWheel = (ev: WheelEvent) => {
+        const screen = term.element?.querySelector(".xterm-screen");
+        const box = screen?.getBoundingClientRect();
+        if (!box || !box.height || !box.width) return;
+        const n = wheelReports(wheelState, ev, box.height / term.rows, term.rows);
+        const ws = wsRef.current;
+        if (!n || !ws || ws.readyState !== WebSocket.OPEN) return;
+        const clamp = (v: number, max: number) => Math.min(max, Math.max(1, v));
+        const col = clamp(
+          Math.floor(((ev.clientX - box.left) / box.width) * term.cols) + 1,
+          term.cols
+        );
+        const row = clamp(
+          Math.floor(((ev.clientY - box.top) / box.height) * term.rows) + 1,
+          term.rows
+        );
+        const button = (n < 0 ? 64 : 65) | (ev.altKey ? 8 : 0) | (ev.ctrlKey ? 16 : 0);
+        ws.send(`\x1b[<${button};${col};${row}M`.repeat(Math.abs(n)));
+      };
       term.attachCustomWheelEventHandler((ev) => {
         const mode = term.modes.mouseTrackingMode;
         const tracked = mode !== "none" && mode !== "x10";
+        // Shift+wheel stays xterm's (it reports nothing for it).
+        if (tracked && !ev.shiftKey) {
+          sendWheel(ev);
+          return false;
+        }
         if (!tracked && ownWheel) {
           if (ev.deltaY && wsRef.current?.readyState === WebSocket.OPEN) {
             wsRef.current.send(`\x1b[<${ev.deltaY < 0 ? 64 : 65};1;1M`);

client/src/components/run/__tests__/PaneChat.test.tsx

@@ -215,6 +215,10 @@ describe("PaneChat — Stop", () => {
       await act(async () => {
         await vi.advanceTimersByTimeAsync(5000);
       });
+      // Send comes back once nothing has said busy for BUSY_HOLD_MS.
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(2600);
+      });
       await waitFor(() => expect(screen.queryByTestId("pane-chat-stop")).toBeNull());
     } finally {
       vi.useRealTimers();
@@ -233,6 +237,10 @@ describe("PaneChat — Stop", () => {
       await act(async () => {
         await vi.advanceTimersByTimeAsync(800);
       });
+      // Send comes back once nothing has said busy for BUSY_HOLD_MS.
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(2600);
+      });
       await waitFor(() => expect(screen.queryByTestId("pane-chat-stop")).toBeNull());
     } finally {
       vi.useRealTimers();
@@ -240,6 +248,32 @@ describe("PaneChat — Stop", () => {
     }
   });
 
+  it("does not flicker to Send when the busy line drops out for a moment", async () => {
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+    vi.mocked(readRunBusy).mockReturnValue(true);
+    try {
+      renderChat();
+      expect(await screen.findByTestId("pane-chat-stop")).toBeInTheDocument();
+      // A redraw: the spinner line is gone for a poll or two.
+      vi.mocked(readRunBusy).mockReturnValue(false);
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(1500);
+      });
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(50);
+      });
+      expect(screen.getByTestId("pane-chat-stop")).toBeInTheDocument();
+      vi.mocked(readRunBusy).mockReturnValue(true);
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(800);
+      });
+      expect(screen.getByTestId("pane-chat-stop")).toBeInTheDocument();
+    } finally {
+      vi.useRealTimers();
+      vi.mocked(readRunBusy).mockReturnValue(false);
+    }
+  });
+
   it("counts a tool with no known busy line as working while its pane draws", async () => {
     vi.useFakeTimers({ shouldAdvanceTime: true });
     vi.mocked(readRunBusy).mockReturnValue(null);
@@ -261,6 +295,10 @@ describe("PaneChat — Stop", () => {
       await act(async () => {
         await vi.advanceTimersByTimeAsync(2800);
       });
+      // Send comes back once nothing has said busy for BUSY_HOLD_MS.
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(2600);
+      });
       await waitFor(() => expect(screen.queryByTestId("pane-chat-stop")).toBeNull());
     } finally {
       vi.useRealTimers();

client/src/components/run/__tests__/TerminalView.test.tsx

@@ -21,6 +21,7 @@ import {
   screen,
   waitFor,
 } from "@testing-library/react";
+import { Terminal } from "@xterm/xterm";
 import { TerminalView, altArrowSeq, loadXterm } from "../TerminalView";
 import { pasteToLane, pasteToRun } from "../../../lib/panePaste";
 import { __resetNativePaste, nativePasteWorks } from "../../../lib/nativePaste";
@@ -326,13 +327,36 @@ describe("TerminalView", () => {
     expect(wheelHandlerMock.mock.calls[0]![0]!(new Event("wheel"))).toBe(false);
   });
 
-  it("lets the wheel through once the pane's program tracks the mouse", () => {
-    // tmux with `mouse on` sets this; the wheel must reach it as a real SGR
-    // report, so returning false here would kill scrolling entirely.
+  /** Gives the mocked terminal an on-screen box: 10px per column and per row. */
+  const screenBox = () => {
+    const term = vi.mocked(Terminal).mock.results[vi.mocked(Terminal).mock.results.length - 1]!
+      .value as { element: HTMLElement };
+    const screen = document.createElement("div");
+    screen.className = "xterm-screen";
+    screen.getBoundingClientRect = () =>
+      ({ left: 0, top: 0, width: termState.cols * 10, height: termState.rows * 10 }) as DOMRect;
+    term.element.appendChild(screen);
+  };
+
+  it("sends a tracked wheel itself, one report per LINES_PER_REPORT rows, at the pointer", () => {
+    // tmux with `mouse on` sets this. xterm would send ONE report per event and
+    // damp a touchpad ×0.3 — a swipe crawled — so the pane sends its own.
     termState.modes.mouseTrackingMode = "any";
     termState.buffer.active.type = "alternate";
     render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
-    expect(wheelHandlerMock.mock.calls[0]![0]!(new Event("wheel"))).toBe(true);
+    screenBox();
+    const ws = MockWebSocket.instances[MockWebSocket.instances.length - 1]!;
+    ws.sent.length = 0;
+    const wheel = wheelHandlerMock.mock.calls[0]![0]!;
+    // A notch of 6 rows: one report, at the cell under the pointer.
+    expect(wheel(new WheelEvent("wheel", { deltaY: -60, clientX: 45, clientY: 72 }))).toBe(false);
+    expect(ws.sent).toEqual(["\x1b[<64;5;8M"]);
+    // A touchpad: 6 steps of 25px = 15 rows, ×0.7 scroll speed = 10.5 rows =
+    // two reports, sent as they add up.
+    ws.sent.length = 0;
+    for (let i = 0; i < 6; i++)
+      wheel(new WheelEvent("wheel", { deltaY: 25, clientX: 5, clientY: 5 }));
+    expect(ws.sent.join("")).toBe("\x1b[<65;1;1M".repeat(2));
   });
 
   it("lets the wheel through on a normal buffer, where xterm scrolls scrollback", () => {
@@ -361,10 +385,11 @@ describe("TerminalView", () => {
     expect(wheel(new WheelEvent("wheel", { deltaY: -100 }))).toBe(false);
     expect(wheel(new WheelEvent("wheel", { deltaY: 100 }))).toBe(false);
     expect(ws.sent).toEqual(["\x1b[<64;1;1M", "\x1b[<65;1;1M"]);
-    // Tracked again (a tmux that does report): xterm sends it, never twice.
+    // Tracked again (a tmux that does report): sent once, by the tracked path.
     termState.modes.mouseTrackingMode = "any";
-    expect(wheel(new WheelEvent("wheel", { deltaY: -100 }))).toBe(true);
-    expect(ws.sent).toHaveLength(2);
+    screenBox();
+    expect(wheel(new WheelEvent("wheel", { deltaY: -100 }))).toBe(false);
+    expect(ws.sent).toHaveLength(3);
   });
 
   it("keeps Shift+Tab in the terminal instead of letting focus escape", () => {
@@ -501,9 +526,7 @@ describe("TerminalView", () => {
     // wrong. The WebGL renderer draws each cell at a fixed position instead
     // (xterm 6 removed the canvas one).
     render(<TerminalView runId="agenthub-lane-1" wsBaseUrl="ws://localhost:4820" />);
-    expect(loadAddonMock.mock.calls.some(([a]) => (a as { __webgl?: boolean }).__webgl)).toBe(
-      true
-    );
+    expect(loadAddonMock.mock.calls.some(([a]) => (a as { __webgl?: boolean }).__webgl)).toBe(true);
   });
 
   it("falls back to the DOM renderer when the browser takes the WebGL context back", () => {

client/src/components/settings/BackupSettings.tsx

@@ -131,6 +131,8 @@ export function BackupSettings() {
               onChange={(v) => setHour(Number(v))}
               label={t("backup.hour")}
               disabled={!state || owned?.hour}
+              // 24 fixed hours: type-ahead finds one; a search box would only add noise.
+              searchable={false}
               options={HOURS.map((h) => ({ value: String(h), label: `${pad(h)}:00` }))}
             />
           </div>

client/src/components/settings/GitIdentitySettings.tsx

@@ -19,15 +19,33 @@
  * the next one below) — and, for
  * a user with their own Linux account (S3), their own HTTPS
  * logins. The host account's HTTPS logins are the shared Git credentials
- * table above it, so this lists them only for a member. The private key and
+ * table above it, so this lists them only for a member. **Commit signing**
+ * (under the author) is PER WORKSPACE: one picker per workspace of the user's
+ * (`PUT /api/me/git/signing/lane`, "Don't sign" by default), the keys that can
+ * sign with Delete, a way out of the old account-wide setting and of a
+ * signing setup the user made themselves, and **Import a key you have** takes
+ * a private key file or paste (`POST /api/me/git/ssh-key/import`). The private key and
  * every token are write-only: the server never returns them. A host identity
  * seen by a non-admin is read-only.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { useCallback, useEffect, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
-import { Cloud, Copy, GitBranch, KeyRound, Plus, RefreshCw, Server, Trash2 } from "lucide-react";
+import {
+  Cloud,
+  Copy,
+  FileKey,
+  GitBranch,
+  KeyRound,
+  PenLine,
+  Plus,
+  RefreshCw,
+  Server,
+  Trash2,
+  Upload,
+} from "lucide-react";
 import { api, type GitIdentity } from "../../lib/api";
+import type { Lane } from "../../lib/types";
 import { confirmDialog } from "../../lib/confirm";
 import { copyText } from "../../lib/clipboard";
 import { toast } from "../../lib/toast";
@@ -216,6 +234,339 @@ function GitHostForm({
   );
 }
 
+/**
+ * Commit signing, PER WORKSPACE: one picker per workspace of the user's
+ * (`PUT /api/me/git/signing/lane` — "Don't sign" by default, so only the
+ * workspaces that need it sign), the keys that can sign, each with Delete,
+ * and Import a key the user already has. The old account-wide setting
+ * (every repo signed) only shows when it is on, with a button that turns it
+ * off; a signing setup the user made themselves in `~/.gitconfig` can be
+ * taken out (their key file stays).
+ */
+function SigningCard({
+  id,
+  keys,
+  keyLabel,
+  busy,
+  run,
+}: {
+  id: GitIdentity;
+  keys: Key[];
+  keyLabel: (keyId: string | null | undefined) => string;
+  busy: boolean;
+  run: (fn: () => Promise<GitIdentity>, done?: string) => Promise<boolean>;
+}) {
+  const { t } = useTranslation("settings");
+  const auth = useAuth().state;
+  const me = auth.mode === "server" ? auth.user : null;
+  const signing = id.signing ?? { state: "off" as const, key: null, path: null };
+  const laneSigning = id.laneSigning ?? [];
+  const [form, setForm] = useState<{ text: string; name: string } | null>(null);
+  const [lanes, setLanes] = useState<Lane[] | null>(null);
+
+  useEffect(() => {
+    let live = true;
+    api.lanes
+      .list()
+      .then((r) => live && setLanes(r.lanes))
+      .catch(() => live && setLanes([]));
+    return () => {
+      live = false;
+    };
+  }, []);
+  // The user's OWN workspaces: an admin sees everyone's, but signs only theirs.
+  const mine = (lanes ?? []).filter((l) => !me || l.owner_id == null || l.owner_id === me.id);
+  const laneName = (l: Lane) => l.title || l.cwd;
+  // Still signing, but its workspace is gone from the list (removed): the
+  // folder keeps signing until it is turned off here.
+  const orphans =
+    lanes === null
+      ? []
+      : laneSigning
+          .filter((x) => !lanes.some((l) => l.id === x.laneId))
+          .map(
+            (x) =>
+              ({
+                id: x.laneId,
+                title: t("gitIdentity.signLaneGone", { id: x.laneId }),
+                cwd: "",
+              }) as Lane
+          );
+  const signedWith = (laneId: number) => laneSigning.find((x) => x.laneId === laneId);
+
+  const chooseLane = async (lane: Lane, keyId: string | null) =>
+    run(
+      () => api.gitIdentity.setLaneSigning(lane.id, keyId),
+      keyId
+        ? t("gitIdentity.signLaneSaved", { name: laneName(lane), key: keyLabel(keyId) })
+        : t("gitIdentity.signLaneStopped", { name: laneName(lane) })
+    );
+
+  const clearForeign = async () => {
+    if (
+      !(await confirmDialog({
+        title: t("gitIdentity.signForeignConfirm", { path: signing.path }),
+        confirmLabel: t("gitIdentity.signForeignRemove"),
+      }))
+    )
+      return;
+    await run(
+      () => api.gitIdentity.setSigning(null, false, true),
+      t("gitIdentity.signForeignRemoved")
+    );
+  };
+
+  const deleteKey = async (k: Key) => {
+    if (
+      !(await confirmDialog({
+        title: t("gitIdentity.signKeyDeleteConfirm", { key: keyLabel(k.id) }),
+        confirmLabel: t("gitIdentity.remove"),
+      }))
+    )
+      return;
+    await run(
+      () => api.gitIdentity.removeKeyById(k.id!),
+      t("gitIdentity.signKeyDeleted", { key: keyLabel(k.id) })
+    );
+  };
+
+  const doImport = async () => {
+    if (!form) return;
+    const ok = await run(
+      () =>
+        api.gitIdentity.importKey({
+          privateKey: form.text,
+          ...(form.name.trim() ? { name: form.name.trim() } : {}),
+        }),
+      t("gitIdentity.imported", { name: form.name.trim() || "signing" })
+    );
+    if (ok) setForm(null);
+  };
+
+  const readFile = async (file: File | undefined) => {
+    if (!file || !form) return;
+    // A key file is a few KB; anything far larger is not one.
+    if (file.size > 32 * 1024) return toast.error(t("gitIdentity.importPaste"));
+    const text = await file.text();
+    setForm({ ...form, text });
+  };
+
+  const usable = keys.filter((k) => k.id);
+
+  return (
+    <section
+      className="space-y-2 rounded-lg border border-border p-3"
+      aria-label={t("gitIdentity.signTitle")}
+    >
+      <div className="flex items-center gap-2">
+        <PenLine className="h-4 w-4 text-fg-muted" aria-hidden />
+        <h3 className="flex-1 text-xs font-semibold text-fg-primary">
+          {t("gitIdentity.signTitle")}
+        </h3>
+        {id.writable && !form && (
+          <button
+            type="button"
+            className={BTN}
+            disabled={busy}
+            onClick={() => setForm({ text: "", name: "" })}
+          >
+            <Upload className="h-3.5 w-3.5" />
+            {t("gitIdentity.importKey")}
+          </button>
+        )}
+      </div>
+      <p className="text-[11px] text-fg-muted">{t("gitIdentity.signIntro")}</p>
+
+      {signing.state === "on" && (
+        <div
+          data-testid="git-signing-legacy"
+          className="flex flex-wrap items-center gap-2 rounded border border-status-warning/40 bg-status-warning/10 px-2.5 py-1.5"
+        >
+          <span className="min-w-0 flex-1 text-[11px] text-fg-primary">
+            {t("gitIdentity.signLegacy", { key: keyLabel(signing.key) })}
+          </span>
+          {id.writable && (
+            <button
+              type="button"
+              className={BTN}
+              disabled={busy}
+              onClick={() =>
+                void run(() => api.gitIdentity.setSigning(null), t("gitIdentity.signLegacyStopped"))
+              }
+            >
+              {t("gitIdentity.signLegacyOff")}
+            </button>
+          )}
+        </div>
+      )}
+
+      {signing.state === "foreign" && (
+        <div
+          data-testid="git-signing-foreign"
+          className="flex flex-wrap items-center gap-2 rounded border border-border px-2.5 py-1.5"
+        >
+          <span className="min-w-0 flex-1 text-[11px] text-fg-secondary [overflow-wrap:anywhere]">
+            {t("gitIdentity.signForeign", { path: signing.path })}
+          </span>
+          {id.writable && (
+            <button
+              type="button"
+              className={`${BTN} hover:text-status-danger`}
+              disabled={busy}
+              onClick={() => void clearForeign()}
+            >
+              <Trash2 className="h-3.5 w-3.5" />
+              {t("gitIdentity.signForeignRemove")}
+            </button>
+          )}
+        </div>
+      )}
+
+      <div className="space-y-1" data-testid="git-signing-lanes">
+        <div className="text-[11px] font-medium text-fg-secondary">
+          {t("gitIdentity.signLanes")}
+        </div>
+        {usable.length === 0 ? (
+          <p className="text-[11px] text-fg-muted">{t("gitIdentity.signNeedKey")}</p>
+        ) : lanes === null ? null : mine.length + orphans.length === 0 ? (
+          <p className="text-[11px] text-fg-muted">{t("gitIdentity.signLanesEmpty")}</p>
+        ) : (
+          [...mine, ...orphans].map((l) => {
+            const on = signedWith(l.id);
+            return (
+              <div key={l.id} className="flex items-center gap-2">
+                <span
+                  className={`min-w-0 flex-1 truncate text-xs ${
+                    on ? "text-status-success" : "text-fg-primary"
+                  }`}
+                  title={l.cwd || undefined}
+                >
+                  {laneName(l)}
+                </span>
+                <select
+                  aria-label={t("gitIdentity.signLaneKey", { name: laneName(l) })}
+                  value={on?.key ?? ""}
+                  disabled={busy || !id.writable}
+                  onChange={(e) => void chooseLane(l, e.target.value || null)}
+                  className="select !w-48 !py-1 !text-xs"
+                >
+                  <option value="">{t("gitIdentity.signNone")}</option>
+                  {usable.map((k) => (
+                    <option key={k.id} value={k.id}>
+                      {keyLabel(k.id)}
+                    </option>
+                  ))}
+                </select>
+              </div>
+            );
+          })
+        )}
+      </div>
+
+      {usable.length > 0 && (
+        <div className="space-y-1" data-testid="git-signing-keys">
+          <div className="text-[11px] font-medium text-fg-secondary">
+            {t("gitIdentity.signKeys")}
+          </div>
+          {usable.map((k) => {
+            const used = laneSigning.filter((x) => x.key === k.id).length;
+            return (
+              <div
+                key={k.id}
+                className="flex items-center gap-2 rounded border border-border px-2 py-1"
+              >
+                <FileKey className="h-3.5 w-3.5 shrink-0 text-fg-muted" aria-hidden />
+                <div className="min-w-0 flex-1">
+                  <div className="truncate text-xs text-fg-primary">{keyLabel(k.id)}</div>
+                  <div className="truncate font-mono text-[10px] text-fg-muted">
+                    {k.fingerprint}
+                    {used > 0 ? ` · ${t("gitIdentity.signKeyUsed", { count: used })}` : ""}
+                  </div>
+                </div>
+                <button
+                  type="button"
+                  className={BTN}
+                  onClick={() => void copyText(k.publicKey)}
+                  aria-label={t("gitIdentity.signKeyCopy", { key: keyLabel(k.id) })}
+                  title={t("gitIdentity.signHostStep")}
+                >
+                  <Copy className="h-3.5 w-3.5" />
+                </button>
+                {id.writable && (
+                  <button
+                    type="button"
+                    className={`${BTN} hover:text-status-danger`}
+                    disabled={busy}
+                    aria-label={t("gitIdentity.removeKeyNamed", { name: keyLabel(k.id) })}
+                    onClick={() => void deleteKey(k)}
+                  >
+                    <Trash2 className="h-3.5 w-3.5" />
+                    {t("gitIdentity.remove")}
+                  </button>
+                )}
+              </div>
+            );
+          })}
+          <p className="text-[10px] text-fg-muted">{t("gitIdentity.signHostStep")}</p>
+        </div>
+      )}
+
+      {form && (
+        <form
+          className="space-y-2 rounded border border-border p-2.5"
+          aria-label={t("gitIdentity.importTitle")}
+          onSubmit={(e) => {
+            e.preventDefault();
+            void doImport();
+          }}
+        >
+          <div className="text-xs font-medium text-fg-primary">{t("gitIdentity.importTitle")}</div>
+          <label className={`${BTN} cursor-pointer`}>
+            <FileKey className="h-3.5 w-3.5" />
+            {t("gitIdentity.importFile")}
+            <input
+              type="file"
+              className="sr-only"
+              onChange={(e) => void readFile(e.target.files?.[0])}
+            />
+          </label>
+          <textarea
+            aria-label={t("gitIdentity.importPaste")}
+            placeholder={t("gitIdentity.importPaste")}
+            value={form.text}
+            spellCheck={false}
+            autoComplete="off"
+            rows={4}
+            onChange={(e) => setForm({ ...form, text: e.target.value })}
+            className={`${INPUT} resize-y font-mono text-[10px]`}
+          />
+          <input
+            aria-label={t("gitIdentity.importName")}
+            placeholder={t("gitIdentity.importName")}
+            value={form.name}
+            autoComplete="off"
+            onChange={(e) => setForm({ ...form, name: e.target.value.toLowerCase() })}
+            className={`${INPUT} !w-40 font-mono`}
+          />
+          <p className="text-[10px] text-fg-muted">{t("gitIdentity.importNote")}</p>
+          <div className="flex gap-2">
+            <button
+              type="submit"
+              disabled={busy || !form.text.trim()}
+              className="rounded border border-accent/40 bg-accent/15 px-3 py-1 text-xs text-accent hover:bg-accent/25 disabled:cursor-not-allowed disabled:opacity-40"
+            >
+              {t("gitIdentity.importSubmit")}
+            </button>
+            <button type="button" onClick={() => setForm(null)} className={BTN}>
+              {t("gitCreds.cancel")}
+            </button>
+          </div>
+        </form>
+      )}
+    </section>
+  );
+}
+
 export function GitIdentitySettings() {
   const { t } = useTranslation("settings");
   const [id, setId] = useState<GitIdentity | null>(null);
@@ -572,6 +923,10 @@ export function GitIdentitySettings() {
         )}
       </form>
 
+      {id.signing !== undefined && (
+        <SigningCard id={id} keys={keys} keyLabel={keyLabel} busy={busy} run={run} />
+      )}
+
       <div className="space-y-3 rounded-lg border border-border p-3">
         <div className="flex items-center gap-2">
           <KeyRound className="h-4 w-4 text-fg-muted" aria-hidden />
@@ -616,6 +971,11 @@ export function GitIdentitySettings() {
                     onRemove={() => removeNamed(k.id!)}
                   >
                     <Step n={2}>{t("gitIdentity.gitHubStepAdd")}</Step>
+                    {id.signing?.state === "on" && id.signing.key === k.id && (
+                      <div className="text-[10px] text-status-success">
+                        {t("gitIdentity.signingBadge")}
+                      </div>
+                    )}
                     <Step n={3}>
                       {t("gitIdentity.namedGitStepHost", { name: k.name })}
                       {loginRows(rows, (r) => `ssh://${r.alias}/ → ${r.user}@${r.host}`)}

client/src/components/settings/MemberPolicySettings.tsx

@@ -0,0 +1,53 @@
+/**
+ * @file MemberPolicySettings — Settings → AI tools → Tests on this server:
+ * the admin's server-wide switch that allows or blocks members' Claude from
+ * running test runners and container commands on this box
+ * (`GET/PUT /api/ai-tools/member-policy`, `server/lib/member-policy.js`,
+ * enforced by `scripts/member-guard.js`). Renders nothing outside server mode
+ * with per-user accounts (S3), or for anyone but an admin.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { api, type MemberPolicyState } from "../../lib/api";
+import { toast } from "../../lib/toast";
+import { usePermissions } from "../AuthGate";
+import { SettingsSection, SettingsSwitchRow } from "./SettingsRow";
+
+export function MemberPolicySettings() {
+  const { t } = useTranslation("settings");
+  const { isAdmin, local } = usePermissions();
+  const [state, setState] = useState<MemberPolicyState | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  useEffect(() => {
+    if (local || !isAdmin) return;
+    api.aiTools
+      .memberPolicy()
+      .then(setState)
+      .catch(() => setState(null));
+  }, [local, isAdmin]);
+
+  if (local || !isAdmin || !state?.available) return null;
+  return (
+    <SettingsSection id="member-policy" title={t("memberPolicy.title")}>
+      <SettingsSwitchRow
+        label={t("memberPolicy.switch")}
+        description={t("memberPolicy.hint")}
+        checked={state.allowTests}
+        disabled={busy}
+        onChange={async (on) => {
+          setBusy(true);
+          try {
+            setState(await api.aiTools.setMemberPolicy(on));
+          } catch (err) {
+            toast.error(err);
+          } finally {
+            setBusy(false);
+          }
+        }}
+      />
+    </SettingsSection>
+  );
+}

client/src/components/settings/ReportSettings.tsx

@@ -222,6 +222,8 @@ export function ReportSettings() {
                 value={String(form.value.hour)}
                 onChange={(v) => set({ hour: Number(v) })}
                 label={t("reports.hour")}
+                // 24 fixed hours: type-ahead finds one; a search box would only add noise.
+                searchable={false}
                 options={HOURS.map((h) => ({ value: String(h), label: `${pad(h)}:00` }))}
               />
             </div>

client/src/components/settings/__tests__/GitIdentitySettings.test.tsx

@@ -7,7 +7,11 @@
  * other host under "Other SSH hosts" — each kind of host in its own tab, so
  * the sections never mix; "Add another key" makes a named key as one more
  * card in its own tab, a second AWS account is saved from that card under
- * the key's name with that key, and a second GitHub key is tied to its host.
+ * the key's name with that key, and a second GitHub key is tied to its host;
+ * commit signing PER WORKSPACE: an imported key signs nothing by itself, one
+ * workspace's picker signs that workspace only, a signing key is deleted from
+ * the card after a confirm, and the old account-wide setting and a setup the
+ * user made themselves each have a way out.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -31,6 +35,18 @@ vi.mock("../../../lib/api", () => ({
       saveHttps: vi.fn(),
       saveAuthor: vi.fn(),
       removeHttps: vi.fn(),
+      importKey: vi.fn(),
+      setSigning: vi.fn(),
+      setLaneSigning: vi.fn(),
+    },
+    lanes: {
+      list: vi.fn(async () => ({
+        lanes: [
+          { id: 1, title: "shop-api", cwd: "/w/shop-api" },
+          { id: 2, title: "", cwd: "/w/docs" },
+        ],
+        counts: {},
+      })),
     },
   },
 }));
@@ -38,6 +54,7 @@ vi.mock("../../../lib/toast", () => ({ toast: { success: vi.fn(), error: vi.fn()
 vi.mock("../../../lib/confirm", () => ({ confirmDialog: vi.fn(() => Promise.resolve(true)) }));
 vi.mock("../../../lib/clipboard", () => ({ copyText: vi.fn(() => Promise.resolve(true)) }));
 
+const OFF = { state: "off" as const, key: null, path: null };
 const KEY = { publicKey: "ssh-ed25519 AAAAC3Nz an@agenthub", fingerprint: "SHA256:abc" };
 const view = (over: Partial<GitIdentity> = {}): GitIdentity => ({
   account: "member",
@@ -335,4 +352,130 @@ describe("GitIdentitySettings", () => {
     });
     expect(await within(work).findByText("ssh://git-2/ → git@github.com")).toBeInTheDocument();
   });
+
+  it("imports a key without signing anything by itself", async () => {
+    const signingKey = {
+      ...KEY,
+      id: "id_ed25519_signing",
+      type: "ed25519" as const,
+      name: "signing",
+    };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(
+      view({ sshKeys: [], signing: { state: "off", key: null, path: null }, laneSigning: [] })
+    );
+    vi.mocked(api.gitIdentity.importKey).mockResolvedValue({
+      ...view({ sshKeys: [signingKey], signing: OFF, laneSigning: [] }),
+      imported: signingKey,
+      signError: null,
+    });
+    render(<GitIdentitySettings />);
+    expect(await screen.findByText(/Import a key you have, or make one/)).toBeInTheDocument();
+    await userEvent.click(await screen.findByRole("button", { name: "Import a key you have" }));
+    const form = screen.getByRole("form", { name: "Import an existing private key" });
+    await userEvent.type(
+      within(form).getByLabelText(/paste the private key/),
+      "-----BEGIN OPENSSH PRIVATE KEY-----x"
+    );
+    await userEvent.click(within(form).getByRole("button", { name: "Import" }));
+    expect(api.gitIdentity.importKey).toHaveBeenCalledWith({
+      privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----x",
+    });
+    // Now there is a key: each workspace gets its own picker, all "Don't sign".
+    expect(
+      await screen.findByLabelText("Signing key for shop-api", {}, { timeout: 5000 })
+    ).toHaveValue("");
+    expect(screen.getByLabelText("Signing key for /w/docs")).toHaveValue("");
+    expect(api.gitIdentity.setSigning).not.toHaveBeenCalled();
+  });
+
+  it("signs one workspace only, and stops it", async () => {
+    const k = { ...KEY, id: "id_ed25519_signing", type: "ed25519" as const, name: "signing" };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(
+      view({ sshKeys: [k], signing: { state: "off", key: null, path: null }, laneSigning: [] })
+    );
+    vi.mocked(api.gitIdentity.setLaneSigning)
+      .mockResolvedValueOnce(
+        view({ sshKeys: [k], signing: OFF, laneSigning: [{ laneId: 1, key: k.id }] })
+      )
+      .mockResolvedValueOnce(view({ sshKeys: [k], signing: OFF, laneSigning: [] }));
+    render(<GitIdentitySettings />);
+    const pick = await screen.findByLabelText("Signing key for shop-api", {}, { timeout: 5000 });
+    await userEvent.selectOptions(pick, k.id);
+    expect(api.gitIdentity.setLaneSigning).toHaveBeenCalledWith(1, k.id);
+    await waitFor(() =>
+      expect(screen.getByLabelText("Signing key for shop-api")).toHaveValue(k.id)
+    );
+    expect(screen.getByLabelText("Signing key for /w/docs")).toHaveValue("");
+    expect(
+      within(screen.getByTestId("git-signing-keys")).getByText(/signs 1 workspace/)
+    ).toBeTruthy();
+    await userEvent.selectOptions(screen.getByLabelText("Signing key for shop-api"), "");
+    expect(api.gitIdentity.setLaneSigning).toHaveBeenLastCalledWith(1, null);
+    expect(api.gitIdentity.setSigning).not.toHaveBeenCalled();
+  });
+
+  it("lists a removed workspace that still signs, so it can be turned off", async () => {
+    const k = { ...KEY, id: "id_ed25519_signing", type: "ed25519" as const, name: "signing" };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(
+      view({ sshKeys: [k], signing: OFF, laneSigning: [{ laneId: 9, key: k.id }] })
+    );
+    vi.mocked(api.gitIdentity.setLaneSigning).mockResolvedValue(
+      view({ sshKeys: [k], signing: OFF, laneSigning: [] })
+    );
+    render(<GitIdentitySettings />);
+    const pick = await screen.findByLabelText(
+      "Signing key for Workspace #9 (removed)",
+      {},
+      { timeout: 5000 }
+    );
+    expect(pick).toHaveValue(k.id);
+    await userEvent.selectOptions(pick, "");
+    expect(api.gitIdentity.setLaneSigning).toHaveBeenCalledWith(9, null);
+    await waitFor(() =>
+      expect(screen.queryByLabelText("Signing key for Workspace #9 (removed)")).toBeNull()
+    );
+  });
+
+  it("deletes a signing key from the signing card, after asking", async () => {
+    const k = { ...KEY, id: "id_ed25519_signing", type: "ed25519" as const, name: "signing" };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(
+      view({
+        sshKeys: [k],
+        signing: { state: "off", key: null, path: null },
+        laneSigning: [{ laneId: 1, key: k.id }],
+      })
+    );
+    vi.mocked(api.gitIdentity.removeKeyById).mockResolvedValue(
+      view({ sshKeys: [], signing: OFF, laneSigning: [] })
+    );
+    render(<GitIdentitySettings />);
+    const keys = await screen.findByTestId("git-signing-keys", {}, { timeout: 5000 });
+    await userEvent.click(within(keys).getByRole("button", { name: "Delete key signing" }));
+    expect(confirmDialog).toHaveBeenCalledWith(
+      expect.objectContaining({ title: expect.stringMatching(/every workspace signing with it/) })
+    );
+    expect(api.gitIdentity.removeKeyById).toHaveBeenCalledWith(k.id);
+    await waitFor(() => expect(screen.queryByTestId("git-signing-keys")).toBeNull());
+  });
+
+  it("turns off the old account-wide signing and removes a setup the user made", async () => {
+    const k = { ...KEY, id: "id_ed25519", type: "ed25519" as const, name: null };
+    vi.mocked(api.gitIdentity.get).mockResolvedValue(
+      view({ sshKeys: [k], signing: { state: "on", key: "id_ed25519", path: null } })
+    );
+    vi.mocked(api.gitIdentity.setSigning).mockResolvedValue(
+      view({ sshKeys: [k], signing: { state: "foreign", key: null, path: "~/.ssh/mine" } })
+    );
+    render(<GitIdentitySettings />);
+    const legacy = await screen.findByTestId("git-signing-legacy");
+    await userEvent.click(within(legacy).getByRole("button", { name: "Sign per workspace only" }));
+    expect(api.gitIdentity.setSigning).toHaveBeenCalledWith(null);
+    const foreign = await screen.findByTestId("git-signing-foreign");
+    expect(foreign).toHaveTextContent("~/.ssh/mine");
+    await userEvent.click(within(foreign).getByRole("button", { name: "Remove" }));
+    expect(confirmDialog).toHaveBeenCalledWith(
+      expect.objectContaining({ title: expect.stringMatching(/key file itself is not deleted/) })
+    );
+    expect(api.gitIdentity.setSigning).toHaveBeenLastCalledWith(null, false, true);
+  });
 });

client/src/components/settings/__tests__/MemberPolicySettings.test.tsx

@@ -0,0 +1,57 @@
+/**
+ * @file Tests for MemberPolicySettings — the admin's "allow members to run
+ * tests" switch in Settings → AI tools: hidden in local mode, for a non-admin
+ * and outside S3, and a toggle saves through PUT /api/ai-tools/member-policy.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import "../../../i18n";
+import { MemberPolicySettings } from "../MemberPolicySettings";
+import { api } from "../../../lib/api";
+
+const perms = vi.hoisted(() => ({ isAdmin: true, local: false }));
+vi.mock("../../AuthGate", () => ({ usePermissions: () => perms }));
+vi.mock("../../../lib/api", () => ({
+  api: { aiTools: { memberPolicy: vi.fn(), setMemberPolicy: vi.fn() } },
+}));
+
+const get = vi.mocked(api.aiTools.memberPolicy);
+const set = vi.mocked(api.aiTools.setMemberPolicy);
+
+describe("MemberPolicySettings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    perms.isAdmin = true;
+    perms.local = false;
+  });
+
+  it("lets an admin allow tests, off by default", async () => {
+    get.mockResolvedValue({ available: true, allowTests: false });
+    set.mockResolvedValue({ available: true, allowTests: true });
+    render(<MemberPolicySettings />);
+    const sw = await screen.findByRole("switch", { name: "Allow members to run tests" });
+    expect(sw).toHaveAttribute("aria-checked", "false");
+    fireEvent.click(sw);
+    await waitFor(() => expect(set).toHaveBeenCalledWith(true));
+    await waitFor(() => expect(sw).toHaveAttribute("aria-checked", "true"));
+  });
+
+  it("hides outside S3", async () => {
+    get.mockResolvedValue({ available: false, allowTests: false });
+    const { container } = render(<MemberPolicySettings />);
+    await waitFor(() => expect(get).toHaveBeenCalled());
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("asks nothing for a non-admin or in local mode", () => {
+    perms.isAdmin = false;
+    const { container } = render(<MemberPolicySettings />);
+    expect(container).toBeEmptyDOMElement();
+    perms.isAdmin = true;
+    perms.local = true;
+    render(<MemberPolicySettings />);
+    expect(get).not.toHaveBeenCalled();
+  });
+});

client/src/components/users/UserAvatar.tsx

@@ -2,7 +2,7 @@
  * @file UserAvatar.tsx
  * @description An account's round picture: the signed-in account's own
  * (`GET /api/me/avatar`) or, with `userId`, another's (`GET
- * /api/users/:id/avatar`, staff only), versioned by `avatarAt`; without one —
+ * /api/users/:id/avatar`, any signed-in account), versioned by `avatarAt`; without one —
  * or when the image fails to load — the first letters of its name. Used by the
  * sidebar's account row, its workspace owner groups, Settings → Account, the
  * Users page and its editor, the pool board and member picker, and System
@@ -23,7 +23,7 @@ export function UserAvatar({
 }: {
   name: string;
   avatarAt?: string | null;
-  /** Another account's (staff only); omitted = the signed-in account's own. */
+  /** Another account's; omitted = the signed-in account's own. */
   userId?: number;
   /** How many letters of the name stand in for a missing picture. */
   letters?: number;

client/src/i18n/locales/en/common.json

@@ -223,5 +223,9 @@
       "errors": "Steps that failed. A few are normal; many may mean the AI got stuck.",
       "tokenFlow": "Input = sent to the AI, Output = written by the AI, Cache = reused from memory (cheaper)."
     }
+  },
+  "select": {
+    "search": "Search…",
+    "noMatch": "No match"
   }
 }

client/src/i18n/locales/en/dashboard.json

@@ -182,6 +182,12 @@
     "historyNone": "No history yet — the server keeps it in memory on Linux, from the moment it starts.",
     "agenthub": "AgentHub",
     "usersTitle": "Users · CPU / RAM now",
-    "usersCount": "{{n}} users"
+    "usersCount": "{{n}} users",
+    "userTipRole": "Role: {{v}}",
+    "userTipToday": "Today: {{cost}} · {{tokens}} tokens",
+    "userTipWork": "{{w}} workspaces · {{s}} sessions",
+    "userTipLastLogin": "Last sign-in: {{v}}",
+    "userTipNever": "never",
+    "userTipDisabled": "Disabled"
   }
 }

client/src/i18n/locales/en/lanes.json

@@ -195,6 +195,7 @@
   "gitBar.pushHint": "git push -u origin HEAD",
   "gitBar.switch": "Branch",
   "gitBar.switchApply": "Switch branch",
+  "gitBar.branchSearch": "Search branches…",
   "gitBar.switchCurrent": "current",
   "gitBar.remoteBranches": "On the remote — switching creates the local branch",
   "gitBar.switchDirty": "Commit, discard or shelve the uncommitted changes first",
@@ -262,6 +263,7 @@
   "jobs.expand": "Show background tasks",
   "uploads.stop": "Stop upload",
   "uploads.stopConfirm": "Click again to stop",
+  "uploads.waiting": "The dashboard is restarting — the upload resumes when it is back.",
   "uploads.stopping": "Stopping…",
   "uploads.stopped_one": "Upload stopped — {{count}} of {{total}} file sent.",
   "uploads.stopped_other": "Upload stopped — {{count}} of {{total}} files sent.",
@@ -385,6 +387,16 @@
   "menu.remove": "Delete workspace…",
   "panel.changes": "Changes",
   "panel.analyst": "Analyst",
+  "panel.preview": "Preview",
+  "preview.title": "Page preview",
+  "preview.address": "Page address",
+  "preview.reload": "Reload",
+  "preview.openTab": "Open in a browser tab",
+  "preview.badUrl": "Can't open that address — only an http(s) page other than AgentHub itself.",
+  "preview.empty": "Type an address, or click a localhost link in the chat or terminal.",
+  "preview.loginHint": "A blank page? The site may forbid embedding or need a login — open it in a browser tab.",
+  "preview.blockedHint": "Sites like YouTube, Google or a login page refuse to show inside another page. A blank page or a broken-page icon means that — open it in a browser tab.",
+  "preview.openTabShort": "Open tab",
   "replay.placeholder": "Message to continue this session…",
   "replay.hint": "Sending resumes the session in a free pane.",
   "replay.send": "Send",
@@ -635,6 +647,7 @@
   "fx.pasted": "Pasted.",
   "fx.crossOnlyWorkspace": "These items can only be pasted where they came from (a session worktree, an extra folder, or between two homes).",
   "fx.needsUpgrade": "This needs the updated server helper — ask an admin to run `agenthub server install-system` once.",
+  "fx.secret": "Hidden folders at the top of a home (.ssh, .config…) are not editable here — use a terminal. For an SSH key to clone or sign commits: Settings → Git.",
   "fx.conflictTitle": "Already there",
   "fx.conflictBody": "This name is taken in the destination: {{names}}",
   "fx.conflictAll": "Do this for every remaining file",

client/src/i18n/locales/en/settings.json

@@ -45,7 +45,6 @@
       "mute": "Mute",
       "unmute": "Unmute",
       "clearAlerts": "Clear alerts",
-      "send": "Send",
       "rename": "Click to rename {{name}}",
       "renameLabel": "Pet name",
       "renameHint": "Enter to save · empty = default name",
@@ -53,13 +52,15 @@
       "attention": "Needs you",
       "attentionError": "errored",
       "attentionWaiting": "waiting on you",
-      "attentionMore": "+{{count}} more in Sessions"
+      "attentionMore": "+{{count}} more in Sessions",
+      "label": "Pet {{name}}",
+      "close": "Close {{name}}",
+      "status": "Status — click to show the sessions that need you"
     },
     "bubbleDismiss": "Dismiss",
     "open": "Open {{name}} companion",
     "closeAvatar": "Close {{name}}",
     "avatarTitle": "{{name}} — Ctrl/⌘+B · drag or arrow keys to move · stroke to pat · right-click for pets",
-    "startFailed": "Couldn't start that session: {{error}}",
     "bubbleOpen": "Open",
     "bubbleMore": "{{list}} +{{count}} more",
     "notify": {
@@ -174,23 +175,6 @@
       "watching": ["on the prowl 👀", "watching your sessions 😼", "eyes peeled 🐾"],
       "sleeping": ["zzz… 💤", "wake me if something happens 😴", "curled up, all calm 🐈"],
       "idle": ["all quiet 😺", "ready when you are 🐾", "just vibing ✨"]
-    },
-    "chat": {
-      "label": "Chat with {{name}}",
-      "close": "Close {{name}}",
-      "new": "New chat",
-      "status": "Status — click to show the sessions that need you",
-      "endTitle": "End this chat?",
-      "endBody": "It is still writing a reply. A new chat stops this session.",
-      "endConfirm": "Stop and start new",
-      "openWorkspace": "Open in workspace",
-      "typing": "typing…",
-      "placeholder": "Ask {{name}} anything…",
-      "emptyTitle": "Hi! I'm {{name}} 🐾",
-      "emptyHint": "Ask me anything — I'll get {{tool}} to answer right here.",
-      "starting": "Starting {{tool}}…",
-      "notStarted": "Waiting for the session to start — if it asks something, open it in the workspace.",
-      "notSent": "Couldn't reach the session's terminal — try again, or open it in the workspace."
     }
   },
   "pricing": {
@@ -883,6 +867,40 @@
     "authorName": "Name",
     "authorEmail": "Email",
     "authorUnset": "Not set yet: commits from the dashboard and your agents fail until a name and email are saved. Filled in from your account — check and save.",
+    "signTitle": "Commit signing",
+    "signIntro": "Choose which workspaces sign their commits — from your terminal, the Changes panel or an agent — with one of your SSH keys. Every other repository stays unsigned.",
+    "signLanes": "Workspaces",
+    "signLanesEmpty": "You have no workspace yet.",
+    "signNeedKey": "Import a key you have, or make one below, to sign with.",
+    "signLaneGone": "Workspace #{{id}} (removed)",
+    "signLaneKey": "Signing key for {{name}}",
+    "signLaneSaved": "{{name}} now signs its commits with {{key}}.",
+    "signLaneStopped": "{{name}} no longer signs its commits.",
+    "signLegacy": "Every commit of your account is signed with {{key}} (the old account-wide setting).",
+    "signLegacyOff": "Sign per workspace only",
+    "signLegacyStopped": "Account-wide signing is off — each workspace keeps its own choice.",
+    "signForeign": "Your ~/.gitconfig signs every commit with a key you set up yourself: {{path}}.",
+    "signForeignRemove": "Remove",
+    "signForeignConfirm": "Take {{path}} out of your ~/.gitconfig? Commits stop being signed with it; the key file itself is not deleted.",
+    "signForeignRemoved": "The old signing setup was taken out of ~/.gitconfig.",
+    "signKeys": "Keys you can sign with",
+    "signKeyUsed_one": "signs {{count}} workspace",
+    "signKeyUsed_other": "signs {{count}} workspaces",
+    "signKeyCopy": "Copy the public key of {{key}}",
+    "signKeyDeleteConfirm": "Delete key {{key}}? Its private file is deleted, every workspace signing with it stops signing, and clones that use it can no longer fetch or push.",
+    "signKeyDeleted": "Key {{key}} deleted.",
+    "signKey": "Signing key",
+    "signNone": "Don't sign",
+    "signHostStep": "Add this public key to your account on the host as a SIGNING key (Gitea/GitHub: SSH / GPG Keys — on Gitea press Verify), and keep your commit email above the same as the host account's.",
+    "importKey": "Import a key you have",
+    "importTitle": "Import an existing private key",
+    "importFile": "Choose the key file",
+    "importPaste": "…or paste the private key (-----BEGIN … PRIVATE KEY-----)",
+    "importName": "Name (optional)",
+    "importNote": "The key must have no passphrase (a dashboard commit has nowhere to type one). It is stored in your own account; only its public half is ever shown again.",
+    "importSubmit": "Import",
+    "imported": "Key {{name}} imported.",
+    "signingBadge": "Signs commits",
     "authorSaved": "Commit author saved.",
     "title": "Your git identity",
     "descriptionMember": "Your own SSH key and HTTPS logins, kept in your own home. Add workspace → Clone uses them, and the clone keeps them for its later fetch, pull and push.",
@@ -904,9 +922,9 @@
     "terminalHint": "A clone, fetch or push you type yourself (in a pane or over SSH) uses this key, then your own ~/.ssh keys. Sets core.sshCommand in your ~/.gitconfig.",
     "terminalForeign": "Your ~/.gitconfig already sets its own core.sshCommand, so AgentHub leaves it alone. Remove it to use this key in the terminal.",
     "sshIntro": "Use the section for where your code lives. Each kind of host takes its own key; you need only the ones you use.",
-    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket",
+    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket · Backlog",
     "gitHubSub": "ED25519 key — the git@… SSH address",
-    "gitHubStepAdd": "Add it to your account on the host: GitHub → Settings → SSH and GPG keys → New SSH key. GitLab: Preferences → SSH Keys. Paste the whole line.",
+    "gitHubStepAdd": "Add it to your account on the host and paste the whole line: GitHub → Settings → SSH and GPG keys. GitLab → Preferences → SSH Keys. Gitea → Settings → SSH / GPG Keys. Backlog → Personal settings → Register SSH key.",
     "awsTitle": "AWS CodeCommit",
     "awsSub": "RSA 4096 key — AWS accepts only RSA",
     "stepCopy": "Copy the public key.",
@@ -932,10 +950,10 @@
     "aliasPlaceholder": "name (optional)",
     "aliasHint": "Leave empty for the default account of this host. Give a name (e.g. aws-prod, lowercase, no dot) for one more account: clone it as ssh://<name>/…",
     "awsMany": "Several AWS accounts? Add another key for each — it is made at once — upload it to that account, then save its SSH key ID in that key’s step 3. Clone with the URL AWS gives you as usual: AgentHub tries each saved account until one can open the repository.",
-    "tabGit": "GitHub · GitLab",
+    "tabGit": "Git (GitHub, GitLab, Gitea, Backlog…)",
     "tabOther": "Other hosts",
     "addKey": "Add another key",
-    "namedGitSub": "ED25519 · for one more GitHub/GitLab account.",
+    "namedGitSub": "ED25519 · for one more account on a git host.",
     "namedGitStepHost": "Tie it to its host, so a clone through ssh://{{name}}/… offers only this key (git@host would log in with the default key’s account):",
     "namedAwsSub": "RSA · for one more AWS account.",
     "removeKeyNamed": "Delete key {{name}}"
@@ -1135,6 +1153,11 @@
       "vi": "Tiếng Việt"
     }
   },
+  "memberPolicy": {
+    "title": "Tests on this server",
+    "switch": "Allow members to run tests",
+    "hint": "Off: members' Claude may not run test runners or container commands here (vitest, jest, phpunit, pytest, npm test, docker, …) — a few at once freeze this shared server, so they test on their own machine. On: they may. Commands typed by hand in a terminal and Codex are not checked either way."
+  },
   "ompSharing": {
     "title": "Oh My Pi login sharing",
     "switch": "Share this server's Oh My Pi login",

client/src/i18n/locales/vi/common.json

@@ -223,5 +223,9 @@
       "errors": "Các bước bị lỗi. Vài lỗi là bình thường; nhiều lỗi có thể nghĩa là AI bị kẹt.",
       "tokenFlow": "Input = gửi cho AI, Output = AI viết ra, Cache = dùng lại từ bộ nhớ đệm (rẻ hơn)."
     }
+  },
+  "select": {
+    "search": "Tìm…",
+    "noMatch": "Không có kết quả"
   }
 }

client/src/i18n/locales/vi/dashboard.json

@@ -182,6 +182,12 @@
     "historyNone": "Chưa có lịch sử — server chỉ giữ trong bộ nhớ trên Linux, tính từ lúc khởi động.",
     "agenthub": "AgentHub",
     "usersTitle": "Người dùng · CPU / RAM hiện tại",
-    "usersCount": "{{n}} người dùng"
+    "usersCount": "{{n}} người dùng",
+    "userTipRole": "Vai trò: {{v}}",
+    "userTipToday": "Hôm nay: {{cost}} · {{tokens}} token",
+    "userTipWork": "{{w}} workspace · {{s}} phiên",
+    "userTipLastLogin": "Đăng nhập gần nhất: {{v}}",
+    "userTipNever": "chưa bao giờ",
+    "userTipDisabled": "Đã vô hiệu hóa"
   }
 }

client/src/i18n/locales/vi/lanes.json

@@ -195,6 +195,7 @@
   "gitBar.pushHint": "git push -u origin HEAD",
   "gitBar.switch": "Nhánh",
   "gitBar.switchApply": "Chuyển nhánh",
+  "gitBar.branchSearch": "Tìm nhánh…",
   "gitBar.switchCurrent": "hiện tại",
   "gitBar.remoteBranches": "Trên remote — switch sẽ tạo nhánh local",
   "gitBar.switchDirty": "Hãy commit, bỏ hoặc cất (shelve) các thay đổi chưa commit trước",
@@ -262,6 +263,7 @@
   "jobs.expand": "Xem các việc chạy nền",
   "uploads.stop": "Ngưng tải lên",
   "uploads.stopConfirm": "Bấm lần nữa để ngưng",
+  "uploads.waiting": "Dashboard đang khởi động lại — tải lên sẽ tiếp tục khi có kết nối.",
   "uploads.stopping": "Đang ngưng…",
   "uploads.stopped_one": "Đã ngưng tải lên — đã gửi {{count}}/{{total}} tệp.",
   "uploads.stopped_other": "Đã ngưng tải lên — đã gửi {{count}}/{{total}} tệp.",
@@ -385,6 +387,16 @@
   "menu.remove": "Xóa workspace…",
   "panel.changes": "Thay đổi",
   "panel.analyst": "Analyst",
+  "panel.preview": "Xem trang",
+  "preview.title": "Xem trước trang web",
+  "preview.address": "Địa chỉ trang",
+  "preview.reload": "Tải lại",
+  "preview.openTab": "Mở trong tab trình duyệt",
+  "preview.badUrl": "Không mở được địa chỉ này — chỉ mở được trang http(s), không phải chính AgentHub.",
+  "preview.empty": "Nhập địa chỉ, hoặc bấm một link localhost trong chat hay terminal.",
+  "preview.loginHint": "Trang trắng? Trang có thể chặn nhúng hoặc cần đăng nhập — hãy mở trong tab trình duyệt.",
+  "preview.blockedHint": "Các trang như YouTube, Google hay trang đăng nhập không cho hiện bên trong trang khác. Thấy trang trắng hoặc biểu tượng lỗi là vì vậy — hãy mở trong tab trình duyệt.",
+  "preview.openTabShort": "Mở tab",
   "replay.placeholder": "Nhắn để tiếp tục session này…",
   "replay.hint": "Gửi tin sẽ resume session trong một pane trống.",
   "replay.send": "Gửi",
@@ -635,6 +647,7 @@
   "fx.pasted": "Đã dán.",
   "fx.crossOnlyWorkspace": "Các mục này chỉ dán được ở nơi chúng được lấy ra (worktree của session, thư mục phụ, hoặc giữa hai home).",
   "fx.needsUpgrade": "Cần cập nhật helper của server — nhờ admin chạy `agenthub server install-system` một lần.",
+  "fx.secret": "Thư mục ẩn ở cấp đầu home (.ssh, .config…) không chỉnh được ở đây — hãy dùng terminal. Cần SSH key để clone hay ký commit: Settings → Git.",
   "fx.conflictTitle": "Đã có sẵn",
   "fx.conflictBody": "Tên này đã có ở nơi đến: {{names}}",
   "fx.conflictAll": "Áp dụng cho tất cả file còn lại",

client/src/i18n/locales/vi/settings.json

@@ -45,7 +45,6 @@
       "mute": "Tắt tiếng",
       "unmute": "Bật tiếng",
       "clearAlerts": "Xoá cảnh báo",
-      "send": "Gửi",
       "rename": "Bấm để đổi tên {{name}}",
       "renameLabel": "Tên pet",
       "renameHint": "Enter để lưu · để trống = tên mặc định",
@@ -53,13 +52,15 @@
       "attention": "Cần bạn xem",
       "attentionError": "bị lỗi",
       "attentionWaiting": "đang chờ bạn",
-      "attentionMore": "+{{count}} phiên khác trong Phiên"
+      "attentionMore": "+{{count}} phiên khác trong Phiên",
+      "label": "Pet {{name}}",
+      "close": "Đóng {{name}}",
+      "status": "Trạng thái — bấm để xem các phiên cần bạn"
     },
     "bubbleDismiss": "Đóng",
     "open": "Mở trợ lý {{name}}",
     "closeAvatar": "Đóng {{name}}",
     "avatarTitle": "{{name}} — Ctrl/⌘+B · kéo hoặc dùng phím mũi tên để di chuyển · vuốt qua lại để xoa đầu · chuột phải để chọn pet",
-    "startFailed": "Không khởi động được phiên: {{error}}",
     "bubbleOpen": "Mở",
     "bubbleMore": "{{list}} và {{count}} phiên khác",
     "notify": {
@@ -162,23 +163,6 @@
       "watching": ["đang tuần tra 👀", "đang canh các phiên của bạn 😼", "mắt mở to 🐾"],
       "sleeping": ["zzz… 💤", "có gì thì gọi mình dậy nhé 😴", "cuộn tròn, mọi thứ yên ổn 🐈"],
       "idle": ["yên ắng quá 😺", "sẵn sàng khi bạn cần 🐾", "chill thôi ✨"]
-    },
-    "chat": {
-      "label": "Trò chuyện với {{name}}",
-      "close": "Đóng {{name}}",
-      "new": "Cuộc trò chuyện mới",
-      "status": "Trạng thái — bấm để xem các phiên cần bạn",
-      "endTitle": "Kết thúc chat này?",
-      "endBody": "Nó vẫn đang trả lời. Chat mới sẽ dừng phiên này.",
-      "endConfirm": "Dừng và bắt đầu mới",
-      "openWorkspace": "Mở trong workspace",
-      "typing": "đang trả lời…",
-      "placeholder": "Hỏi {{name}} bất cứ điều gì…",
-      "emptyTitle": "Chào bạn! Mình là {{name}} 🐾",
-      "emptyHint": "Hỏi gì cũng được — mình sẽ nhờ {{tool}} trả lời ngay tại đây.",
-      "starting": "Đang khởi động {{tool}}…",
-      "notStarted": "Đang chờ phiên khởi động — nếu nó hỏi gì, hãy mở trong workspace.",
-      "notSent": "Không gửi được tới terminal của phiên — thử lại, hoặc mở trong workspace."
     }
   },
   "pricing": {
@@ -871,6 +855,40 @@
     "authorName": "Tên",
     "authorEmail": "Email",
     "authorUnset": "Chưa đặt: commit từ dashboard và từ agent của bạn sẽ lỗi cho tới khi lưu tên và email. Đã điền sẵn từ tài khoản — kiểm tra rồi bấm Lưu.",
+    "signTitle": "Ký commit",
+    "signIntro": "Chọn workspace nào ký commit — từ terminal, bảng Changes hay agent — bằng một SSH key của bạn. Các repo khác không ký.",
+    "signLanes": "Workspace",
+    "signLanesEmpty": "Bạn chưa có workspace nào.",
+    "signNeedKey": "Hãy nhập key bạn có, hoặc tạo key ở phần dưới, để dùng ký.",
+    "signLaneGone": "Workspace #{{id}} (đã xóa)",
+    "signLaneKey": "Key ký cho {{name}}",
+    "signLaneSaved": "{{name}} giờ ký commit bằng {{key}}.",
+    "signLaneStopped": "{{name}} không còn ký commit.",
+    "signLegacy": "Mọi commit của tài khoản đang được ký bằng {{key}} (cài đặt cũ cho cả tài khoản).",
+    "signLegacyOff": "Chỉ ký theo workspace",
+    "signLegacyStopped": "Đã tắt ký cho cả tài khoản — mỗi workspace giữ lựa chọn riêng.",
+    "signForeign": "~/.gitconfig của bạn đang ký mọi commit bằng key bạn tự cài: {{path}}.",
+    "signForeignRemove": "Gỡ",
+    "signForeignConfirm": "Gỡ {{path}} khỏi ~/.gitconfig? Commit sẽ không còn ký bằng key này; file key không bị xóa.",
+    "signForeignRemoved": "Đã gỡ cấu hình ký cũ khỏi ~/.gitconfig.",
+    "signKeys": "Key dùng để ký",
+    "signKeyUsed_one": "ký {{count}} workspace",
+    "signKeyUsed_other": "ký {{count}} workspace",
+    "signKeyCopy": "Sao chép public key của {{key}}",
+    "signKeyDeleteConfirm": "Xóa key {{key}}? File khóa riêng sẽ bị xóa, các workspace đang ký bằng key này sẽ ngừng ký, và các bản clone dùng key này không fetch/push được nữa.",
+    "signKeyDeleted": "Đã xóa key {{key}}.",
+    "signKey": "Key dùng để ký",
+    "signNone": "Không ký",
+    "signHostStep": "Thêm public key này vào tài khoản trên host dưới dạng key KÝ (Gitea/GitHub: SSH / GPG Keys — trên Gitea bấm Verify), và giữ email commit ở trên trùng với email tài khoản trên host.",
+    "importKey": "Nhập key có sẵn",
+    "importTitle": "Nhập private key có sẵn",
+    "importFile": "Chọn file key",
+    "importPaste": "…hoặc dán private key (-----BEGIN … PRIVATE KEY-----)",
+    "importName": "Tên (không bắt buộc)",
+    "importNote": "Key không được có passphrase (commit từ dashboard không có chỗ nhập). Key được lưu trong tài khoản của chính bạn; sau khi nhập chỉ public key được hiển thị.",
+    "importSubmit": "Nhập",
+    "imported": "Đã nhập key {{name}}.",
+    "signingBadge": "Ký commit",
     "authorSaved": "Đã lưu tác giả commit.",
     "title": "Danh tính git của bạn",
     "descriptionMember": "SSH key và đăng nhập HTTPS riêng của bạn, lưu trong home của chính bạn. Add workspace → Clone dùng chúng, và bản clone giữ lại cho các lần fetch, pull, push sau.",
@@ -892,9 +910,9 @@
     "terminalHint": "Lệnh clone, fetch hay push bạn tự gõ (trong pane hoặc qua SSH) sẽ dùng key này, sau đó tới các key trong ~/.ssh của bạn. Ghi core.sshCommand vào ~/.gitconfig của bạn.",
     "terminalForeign": "~/.gitconfig của bạn đã tự đặt core.sshCommand nên AgentHub không động vào. Xoá nó đi nếu muốn dùng key này trong terminal.",
     "sshIntro": "Dùng đúng mục theo nơi chứa code của bạn. Mỗi loại host dùng một key riêng; chỉ cần tạo key cho nơi bạn dùng.",
-    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket",
+    "gitHubTitle": "GitHub · GitLab · Gitea · Bitbucket · Backlog",
     "gitHubSub": "Key ED25519 — địa chỉ SSH dạng git@…",
-    "gitHubStepAdd": "Thêm vào tài khoản trên host: GitHub → Settings → SSH and GPG keys → New SSH key. GitLab: Preferences → SSH Keys. Dán nguyên dòng.",
+    "gitHubStepAdd": "Thêm vào tài khoản trên host, dán nguyên dòng: GitHub → Settings → SSH and GPG keys. GitLab → Preferences → SSH Keys. Gitea → Settings → SSH / GPG Keys. Backlog → Cài đặt cá nhân → Đăng ký SSH key.",
     "awsTitle": "AWS CodeCommit",
     "awsSub": "Key RSA 4096 — AWS chỉ nhận RSA",
     "stepCopy": "Copy public key.",
@@ -920,10 +938,10 @@
     "aliasPlaceholder": "tên (tuỳ chọn)",
     "aliasHint": "Để trống cho tài khoản mặc định của host này. Đặt tên (vd aws-prod, chữ thường, không dấu chấm) cho thêm một tài khoản: clone bằng ssh://<tên>/…",
     "awsMany": "Nhiều tài khoản AWS? Bấm Thêm key khác cho mỗi tài khoản — key được tạo ngay — upload lên tài khoản đó, rồi lưu SSH key ID ở bước 3 của key đó. Clone bằng URL AWS đưa như bình thường: AgentHub tự thử từng tài khoản đã lưu đến khi mở được repository.",
-    "tabGit": "GitHub · GitLab",
+    "tabGit": "Git (GitHub, GitLab, Gitea, Backlog…)",
     "tabOther": "Host khác",
     "addKey": "Thêm key khác",
-    "namedGitSub": "ED25519 · cho thêm một tài khoản GitHub/GitLab.",
+    "namedGitSub": "ED25519 · cho thêm một tài khoản trên git host.",
     "namedGitStepHost": "Gắn key với host của nó, để clone qua ssh://{{name}}/… chỉ dùng đúng key này (git@host sẽ đăng nhập bằng tài khoản của key mặc định):",
     "namedAwsSub": "RSA · cho thêm một tài khoản AWS.",
     "removeKeyNamed": "Xoá key {{name}}"
@@ -1123,6 +1141,11 @@
       "vi": "Tiếng Việt"
     }
   },
+  "memberPolicy": {
+    "title": "Chạy test trên server này",
+    "switch": "Cho phép thành viên chạy test",
+    "hint": "Tắt: Claude của thành viên không được chạy test hay lệnh container ở đây (vitest, jest, phpunit, pytest, npm test, docker, …) — vài lượt chạy cùng lúc là server dùng chung bị đứng, nên họ test trên máy của mình. Bật: được phép chạy. Lệnh tự gõ trong terminal và Codex thì không bị kiểm tra trong cả hai trường hợp."
+  },
   "ompSharing": {
     "title": "Dùng chung đăng nhập Oh My Pi",
     "switch": "Dùng chung đăng nhập Oh My Pi của máy chủ",

client/src/lib/__tests__/openInPreview.test.ts

@@ -0,0 +1,84 @@
+/**
+ * @file openInPreview.test.ts
+ * @description The one link rule: which URLs the Preview takes (http(s),
+ * never the dashboard's origin, `0.0.0.0` read as `localhost`), that a local
+ * link goes to the session panel only when one answers, and that a
+ * Ctrl/Cmd click keeps the browser's own tab.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  OPEN_IN_PREVIEW_EVENT,
+  isLoopbackUrl,
+  normalizePreviewUrl,
+  onLinkClick,
+  openInPreview,
+  type OpenInPreview,
+} from "../openInPreview";
+
+const SELF = "http://localhost:4820";
+
+describe("normalizePreviewUrl", () => {
+  it("adds http:// to a bare host:port and reads 0.0.0.0 as localhost", () => {
+    expect(normalizePreviewUrl("localhost:3000", SELF)).toBe("http://localhost:3000/");
+    expect(normalizePreviewUrl("http://0.0.0.0:5173/a", SELF)).toBe("http://localhost:5173/a");
+  });
+  it("refuses the dashboard's own origin, other schemes and credentials", () => {
+    expect(normalizePreviewUrl("http://localhost:4820/settings", SELF)).toBeNull();
+    expect(normalizePreviewUrl("javascript:alert(1)", SELF)).toBeNull();
+    expect(normalizePreviewUrl("file:///etc/passwd", SELF)).toBeNull();
+    expect(normalizePreviewUrl("http://u:p@localhost:3000", SELF)).toBeNull();
+    expect(normalizePreviewUrl("  ", SELF)).toBeNull();
+  });
+  it("accepts an external https page", () => {
+    expect(normalizePreviewUrl("https://example.com/x", SELF)).toBe("https://example.com/x");
+  });
+});
+
+describe("isLoopbackUrl", () => {
+  it("is true only for this machine's hosts", () => {
+    expect(isLoopbackUrl("http://localhost:3000")).toBe(true);
+    expect(isLoopbackUrl("http://127.0.0.1:8080/x")).toBe(true);
+    expect(isLoopbackUrl("http://[::1]:3000")).toBe(true);
+    expect(isLoopbackUrl("https://github.com")).toBe(false);
+    expect(isLoopbackUrl("not a url")).toBe(false);
+  });
+});
+
+describe("openInPreview", () => {
+  let off: (() => void) | null = null;
+  afterEach(() => off?.());
+  const listen = (take: boolean) => {
+    const seen: string[] = [];
+    const fn = (e: Event) => {
+      const d = (e as CustomEvent<OpenInPreview>).detail;
+      seen.push(d.url);
+      if (take) d.handled = true;
+    };
+    window.addEventListener(OPEN_IN_PREVIEW_EVENT, fn);
+    off = () => window.removeEventListener(OPEN_IN_PREVIEW_EVENT, fn);
+    return seen;
+  };
+
+  it("hands a local page to a listening panel", () => {
+    const seen = listen(true);
+    expect(openInPreview("http://localhost:3000/login")).toBe(true);
+    expect(seen).toEqual(["http://localhost:3000/login"]);
+  });
+  it("falls back when no panel takes it, and never sends an external page", () => {
+    const seen = listen(false);
+    expect(openInPreview("http://localhost:3000")).toBe(false);
+    expect(openInPreview("https://github.com/login")).toBe(false);
+    expect(seen).toEqual(["http://localhost:3000/"]);
+  });
+  it("leaves a Ctrl/Cmd click to the browser", () => {
+    listen(true);
+    const preventDefault = vi.fn();
+    const base = { ctrlKey: false, metaKey: false, shiftKey: false, button: 0, preventDefault };
+    onLinkClick({ ...base, ctrlKey: true }, "http://localhost:3000");
+    expect(preventDefault).not.toHaveBeenCalled();
+    onLinkClick(base, "http://localhost:3000");
+    expect(preventDefault).toHaveBeenCalledTimes(1);
+  });
+});

client/src/lib/__tests__/panePaste.test.ts

@@ -432,6 +432,14 @@ describe("readRunBusy", () => {
     let rows = ["✻ Thinking… (4s · ↓ 120 tokens · esc to interrupt)"];
     const off = registerPane("agenthub-lane-8", () => {}, () => true, undefined, undefined, () => rows);
     expect(readRunBusy("agenthub-lane-8", "claude")).toBe(true);
+    // Claude's spinner with the footer's hint gone (a narrow pane, a tip).
+    rows = ["✶ Skedaddling… (41s · ↓ 2.8k tokens · thought for 2s)", "  ⏵⏵ auto mode on"];
+    expect(readRunBusy("agenthub-lane-8", "claude")).toBe(true);
+    rows = ["✻ Thinking… (1m 3s)"];
+    expect(readRunBusy("agenthub-lane-8", "claude")).toBe(true);
+    // The line a finished turn leaves is not.
+    rows = ["✻ Cooked for 1m 2s", "❯ "];
+    expect(readRunBusy("agenthub-lane-8", "claude")).toBe(false);
     // Claude's permission footer is not a turn at work.
     rows = ["Esc to cancel · Tab to amend"];
     expect(readRunBusy("agenthub-lane-8", "claude")).toBe(false);

client/src/lib/__tests__/uploadStaged.test.ts

@@ -0,0 +1,134 @@
+/**
+ * @file uploadStaged.test.ts
+ * @description The resumable File Explorer upload (`api.files.uploadStaged`):
+ * a file goes in parts to `/fs/upload-part` and is committed with
+ * `?staged=<id>`; a dashboard that goes away mid-way (network error, a
+ * proxy's bare 502) is waited out and the upload resumes from the byte the
+ * server reports; a refusal with our own error code is not retried.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { api, newUploadId } from "../api";
+
+type Answer = { status: number; body?: unknown } | "neterr";
+
+/** A fake XHR that answers each send with the next scripted answer. */
+class FakeXhr {
+  static answers: ((url: string, size: number) => Answer)[] = [];
+  static sent: { url: string; size: number }[] = [];
+  status = 0;
+  responseText = "";
+  upload: { onprogress: ((e: { loaded: number }) => void) | null } = { onprogress: null };
+  onload: (() => void) | null = null;
+  onerror: (() => void) | null = null;
+  onabort: (() => void) | null = null;
+  private url = "";
+  open(_m: string, url: string) {
+    this.url = url;
+  }
+  setRequestHeader() {}
+  abort() {
+    this.onabort?.();
+  }
+  send(body: Blob) {
+    FakeXhr.sent.push({ url: this.url, size: body.size });
+    const next = FakeXhr.answers.shift();
+    const a = next ? next(this.url, body.size) : { status: 500, body: { error: { code: "EX" } } };
+    queueMicrotask(() => {
+      if (a === "neterr") return this.onerror?.();
+      this.status = a.status;
+      this.responseText = a.body === undefined ? "" : JSON.stringify(a.body);
+      this.onload?.();
+    });
+  }
+}
+
+const MB = 1024 * 1024;
+const q = (url: string) => new URL(url, "http://x").searchParams;
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  FakeXhr.answers = [];
+  FakeXhr.sent = [];
+  vi.stubGlobal("XMLHttpRequest", FakeXhr);
+});
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+
+describe("api.files.uploadStaged", () => {
+  it("sends parts, waits out a restart, resumes from the server's count, then commits", async () => {
+    const file = new Blob([new Uint8Array(20 * MB)]);
+    const upload = newUploadId();
+    expect(upload).toMatch(/^[0-9a-f]{32}$/);
+    // part 1 ok; part 2 dies with the server; part 2 again after the restart;
+    // part 3; the commit's answer is lost once; then the stored answer.
+    FakeXhr.answers = [
+      () => ({ status: 200, body: { received: 8 * MB } }),
+      () => "neterr",
+      (url) => ({ status: 200, body: { received: Number(q(url).get("offset")) + 8 * MB } }),
+      () => ({ status: 200, body: { received: 20 * MB } }),
+      () => ({ status: 502 }),
+      () => ({ status: 201, body: { path: "big.bin" } }),
+    ];
+    // While away: the status read says 10 MB arrived before the server died.
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(JSON.stringify({ received: 10 * MB, total: 20 * MB, done: false }), {
+          headers: { "content-type": "application/json" },
+        })
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    const waits: boolean[] = [];
+    const done = api.files.uploadStaged(7, "big.bin", file, "fail", {
+      upload,
+      onWait: (w) => waits.push(w),
+    });
+    await vi.runAllTimersAsync();
+    await expect(done).resolves.toEqual({ path: "big.bin" });
+    const parts = FakeXhr.sent.filter((s) => s.url.includes("/upload-part"));
+    expect(parts.map((p) => [q(p.url).get("offset"), p.size])).toEqual([
+      ["0", 8 * MB],
+      [String(8 * MB), 8 * MB],
+      [String(10 * MB), 8 * MB],
+      [String(18 * MB), 2 * MB],
+    ]);
+    for (const p of parts) expect(q(p.url).get("upload")).toBe(upload);
+    const commits = FakeXhr.sent.filter((s) => s.url.includes("/fs/upload?"));
+    expect(commits).toHaveLength(2);
+    expect(q(commits[0]!.url).get("staged")).toBe(upload);
+    expect(q(commits[0]!.url).get("path")).toBe("big.bin");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(waits).toEqual([true, false, true, false]);
+  });
+
+  it("goes on from the server's count on EOFFSET, and never retries our own refusal", async () => {
+    const file = new Blob([new Uint8Array(10)]);
+    FakeXhr.answers = [
+      () => ({ status: 409, body: { error: { code: "EOFFSET", message: "x", received: 10 } } }),
+      () => ({ status: 409, body: { error: { code: "EEXISTS", message: "taken", names: ["a"] } } }),
+    ];
+    const done = api.files.uploadStaged(7, "a", file, "fail", { upload: newUploadId() });
+    const settled = expect(done).rejects.toMatchObject({ code: "EEXISTS", names: ["a"] });
+    await vi.runAllTimersAsync();
+    await settled;
+    expect(FakeXhr.sent).toHaveLength(2);
+  });
+
+  it("gives up once the dashboard has been away too long", async () => {
+    const file = new Blob([new Uint8Array(4)]);
+    FakeXhr.answers = Array.from({ length: 200 }, () => () => "neterr" as const);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        throw new TypeError("Failed to fetch");
+      })
+    );
+    const done = api.files.uploadStaged(7, "a", file, "fail", { upload: newUploadId() });
+    const settled = expect(done).rejects.toMatchObject({ code: "ENET" });
+    await vi.runAllTimersAsync();
+    await settled;
+  });
+});

client/src/lib/__tests__/wheelReports.test.ts

@@ -0,0 +1,52 @@
+/**
+ * @file wheelReports.test.ts
+ * @description A touchpad scrolls 1:1 with the finger (one report per
+ * LINES_PER_REPORT rows, remainder carried), a wheel notch always sends one.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect } from "vitest";
+import { LINES_PER_REPORT, SCROLL_SPEED, wheelReports, type WheelState } from "../wheelReports";
+
+const ROW = 20;
+const px = (deltaY: number) => ({ deltaY, deltaMode: 0 });
+
+describe("wheelReports", () => {
+  it("adds small touchpad steps up to one report per LINES_PER_REPORT rows", () => {
+    const s: WheelState = { partial: 0 };
+    let sent = 0;
+    // 110 steps of 10px = 1100px = 55 rows, scrolled at SCROLL_SPEED.
+    for (let i = 0; i < 110; i++) sent += wheelReports(s, px(10), ROW, 40);
+    expect(sent).toBe(Math.trunc((55 * SCROLL_SPEED) / LINES_PER_REPORT));
+  });
+
+  it("drops the carried remainder when the swipe turns around", () => {
+    const s: WheelState = { partial: 0 };
+    wheelReports(s, px(40), ROW, 40); // 2 rows down, nothing sent yet
+    let sent = 0;
+    // 8 rows up = 5.6 scrolled: one report, the 2 rows down forgotten.
+    for (let i = 0; i < 8; i++) sent += wheelReports(s, px(-20), ROW, 40);
+    expect(sent).toBe(-1);
+  });
+
+  it("sends at least one report for a wheel notch, in either delta mode", () => {
+    expect(wheelReports({ partial: 0 }, px(100), ROW, 40)).toBe(1);
+    expect(wheelReports({ partial: 0 }, px(-100), ROW, 40)).toBe(-1);
+    expect(wheelReports({ partial: 0 }, { deltaY: 3, deltaMode: 1 }, ROW, 40)).toBe(1);
+    expect(wheelReports({ partial: 0 }, { deltaY: 1, deltaMode: 2 }, ROW, 40)).toBe(6); // 8 × 0.7
+  });
+
+  it("slows a run of wheel notches to SCROLL_SPEED of a report each", () => {
+    const s: WheelState = { partial: 0 };
+    let sent = 0;
+    for (let i = 0; i < 10; i++) sent += wheelReports(s, px(100), ROW, 40);
+    expect(sent).toBe(10 * SCROLL_SPEED);
+    // Turning around starts from zero: the first notch up moves at once.
+    expect(wheelReports(s, px(-100), ROW, 40)).toBe(-1);
+  });
+
+  it("sends nothing for a horizontal-only event or an unmeasured terminal", () => {
+    expect(wheelReports({ partial: 0 }, px(0), ROW, 40)).toBe(0);
+    expect(wheelReports({ partial: 0 }, px(10), 0, 40)).toBe(0);
+  });
+});

client/src/lib/api.ts

@@ -1188,7 +1188,9 @@ const sendRaw = <T>(
     xhr.upload.onprogress = (e) => onProgress?.(e.loaded);
     xhr.onerror = () => reject(Object.assign(new Error("network error"), { code: "ENET" }));
     xhr.onload = () => {
-      let body: { error?: { code?: string; message?: string; names?: string[] } } = {};
+      let body: {
+        error?: { code?: string; message?: string; names?: string[]; received?: number };
+      } = {};
       try {
         body = JSON.parse(xhr.responseText);
       } catch {
@@ -1206,12 +1208,148 @@ const sendRaw = <T>(
           code: body.error?.code,
           status: xhr.status,
           names: body.error?.names,
+          received: body.error?.received,
         })
       );
     };
     xhr.send(payload);
   });
 
+/**
+ * A batch body (`/fs/upload-batch`): a 4-byte length, the JSON file list,
+ * then each file's bytes. The Blob is only composed, never read into memory.
+ */
+function batchBody(files: { file: Blob; rel: string }[]): Blob {
+  const head = new TextEncoder().encode(
+    JSON.stringify({
+      files: files.map((f) => ({
+        path: f.rel,
+        size: f.file.size,
+        mtime: f.file instanceof File ? f.file.lastModified : undefined,
+      })),
+    })
+  );
+  const len = new Uint8Array(4);
+  new DataView(len.buffer).setUint32(0, head.length);
+  return new Blob([len, head, ...files.map((f) => f.file)], { type: "application/octet-stream" });
+}
+
+/** One part of a resumable upload (the server takes at most 16 MB). */
+const UPLOAD_PART_BYTES = 8 * 1024 * 1024;
+/** How long an upload waits for the dashboard to come back (a restart, an update). */
+const UPLOAD_WAIT_MS = 3 * 60 * 1000;
+
+/** A fresh id for one resumable upload (also outside a secure context). */
+export function newUploadId(): string {
+  const b = new Uint8Array(16);
+  crypto.getRandomValues(b);
+  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+}
+
+type SendErr = Error & { code?: string; status?: number; received?: number };
+
+/**
+ * The dashboard is away (restarting) rather than refusing: worth waiting for.
+ * A 5xx with none of our error codes is a proxy (nginx, Vite) answering for it.
+ */
+const isAway = (e: SendErr) =>
+  e.code === "ENET" || e.code === "EBUSY" || ((e.status ?? 0) >= 500 && !e.code);
+
+const pause = (ms: number, signal?: AbortSignal) =>
+  new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        reject(Object.assign(new Error("aborted"), { code: "EABORT" }));
+      },
+      { once: true }
+    );
+  });
+
+/** Callbacks of a resumable upload. */
+export interface StagedSendOpts {
+  /** The upload's id: pass the SAME one to retry a commit (another `conflict`) without resending. */
+  upload: string;
+  onProgress?: (sent: number) => void;
+  /** true while the dashboard is away and the upload waits to resume. */
+  onWait?: (waiting: boolean) => void;
+  signal?: AbortSignal;
+}
+
+/**
+ * Send `payload` in parts to `place`'s staging (`/fs/upload-part`), then
+ * POST `commitUrl(id)` to write it. A dropped connection or a restarting
+ * dashboard (network error, 502/503/504) is waited out for up to
+ * UPLOAD_WAIT_MS, and the upload resumes from the byte the server has.
+ */
+async function sendStaged<T>(
+  place: FsPlace,
+  commitUrl: (id: string) => string,
+  payload: Blob,
+  { upload, onProgress, onWait, signal }: StagedSendOpts
+): Promise<T> {
+  const total = payload.size;
+  let received = 0;
+  let awaySince = 0;
+  let delay = 500;
+  const waitOut = async (e: SendErr) => {
+    if (!isAway(e)) throw e;
+    if (!awaySince) awaySince = Date.now();
+    if (Date.now() - awaySince > UPLOAD_WAIT_MS) throw e;
+    onWait?.(true);
+    await pause(delay, signal);
+    delay = Math.min(delay * 2, 5000);
+  };
+  const back = () => {
+    if (awaySince) onWait?.(false);
+    awaySince = 0;
+    delay = 500;
+  };
+  const partUrl = (q: Record<string, string>) =>
+    fsUrl(place, "/upload-part", new URLSearchParams({ upload, ...q }));
+  // An empty file is still one (empty) part: it makes the upload known.
+  do {
+    try {
+      const r = await sendRaw<{ received: number }>(
+        partUrl({ offset: String(received), total: String(total) }),
+        payload.slice(received, received + UPLOAD_PART_BYTES),
+        (n) => onProgress?.(received + n),
+        signal
+      );
+      received = r.received;
+      back();
+    } catch (err) {
+      const e = err as SendErr;
+      if (e.code === "EOFFSET" && typeof e.received === "number") {
+        // The server has more (or less) than we thought: go on from there.
+        received = e.received;
+        back();
+        continue;
+      }
+      await waitOut(e);
+      try {
+        const s = await request<{ received: number; done: boolean }>(partUrl({}));
+        received = s.received;
+      } catch {
+        /* still away: the next part asks again */
+      }
+    }
+    onProgress?.(received);
+  } while (received < total);
+  for (;;) {
+    try {
+      const r = await sendRaw<T>(commitUrl(upload), new Blob([]), undefined, signal);
+      back();
+      return r;
+    } catch (err) {
+      // A commit whose answer was lost is answered again, never written twice.
+      await waitOut(err as SendErr);
+    }
+  }
+}
+
 /** A home the File Explorer can open (`GET /api/homes`): `me`, or another user's for an admin. */
 export interface FsHome {
   id: string;
@@ -1430,7 +1568,7 @@ export const api = {
   },
   // ───────────────────────── Server mode staff views (routes/users.js) ─────────────────────────
   users: {
-    /** URL of one account's avatar (admin/analyst), versioned by `avatarAt` (null = none). */
+    /** URL of one account's avatar (any signed-in account), versioned by `avatarAt` (null = none). */
     avatarUrl: (id: number, avatarAt?: string | null) =>
       avatarAt ? `${BASE}/users/${id}/avatar?v=${encodeURIComponent(avatarAt)}` : null,
     /** GET /api/users — every account with its recent usage (admin/analyst). */
@@ -1720,6 +1858,8 @@ export const api = {
       archived?: boolean;
       /** Pinned sessions first (by pin time), before the limit. */
       pinnedFirst?: boolean;
+      /** Server mode: the caller's OWN sessions, even for an admin/analyst (`mine=1`). */
+      mine?: boolean;
       /** Only active sessions waiting on the user (`awaiting=1`). */
       awaiting?: boolean;
       /** ISO bounds on `started_at`. */
@@ -1740,6 +1880,7 @@ export const api = {
       if (params?.archived !== undefined) qs.set("archived", params.archived ? "1" : "0");
       if (params?.pinnedFirst) qs.set("pinned_first", "1");
       if (params?.awaiting) qs.set("awaiting", "1");
+      if (params?.mine) qs.set("mine", "1");
       if (params?.from) qs.set("from", params.from);
       if (params?.to) qs.set("to", params.to);
       if (params?.sort_by) qs.set("sort_by", params.sort_by);
@@ -3300,6 +3441,28 @@ export const api = {
         onProgress,
         signal
       ),
+    /**
+     * {@link files.upload}, resumable: sent in parts and written once whole,
+     * so a dashboard restart mid-way only pauses it ({@link sendStaged}).
+     */
+    uploadStaged: (
+      t: FsPlace,
+      path: string,
+      file: Blob,
+      conflict: FsConflict,
+      opts: StagedSendOpts
+    ) =>
+      sendStaged<{ path: string; skipped?: boolean }>(
+        t,
+        (staged) => fsUrl(t, "/upload", new URLSearchParams({ path, conflict, staged })),
+        file,
+        opts
+      ),
+    /** Forget a resumable upload's staged bytes (stopped, or given up). Never throws. */
+    dropUpload: (t: FsPlace, upload: string) =>
+      request<{ dropped: boolean }>(fsUrl(t, "/upload-part", new URLSearchParams({ upload })), {
+        method: "DELETE",
+      }).catch(() => null),
     /**
      * Many small files in ONE request, under the folder `dir` (each `rel`
      * relative to it): a 4-byte length, the JSON file list, then the bytes.
@@ -3312,25 +3475,27 @@ export const api = {
       conflict: FsConflict = "fail",
       onProgress?: (sent: number) => void,
       signal?: AbortSignal
-    ) => {
-      const head = new TextEncoder().encode(
-        JSON.stringify({
-          files: files.map((f) => ({
-            path: f.rel,
-            size: f.file.size,
-            mtime: f.file instanceof File ? f.file.lastModified : undefined,
-          })),
-        })
-      );
-      const len = new Uint8Array(4);
-      new DataView(len.buffer).setUint32(0, head.length);
-      return sendRaw<{ saved: number; skipped: number; paths: string[] }>(
+    ) =>
+      sendRaw<{ saved: number; skipped: number; paths: string[] }>(
         fsUrl(t, "/upload-batch", new URLSearchParams({ dir, conflict })),
-        new Blob([len, head, ...files.map((f) => f.file)], { type: "application/octet-stream" }),
+        batchBody(files),
         onProgress,
         signal
-      );
-    },
+      ),
+    /** {@link files.uploadBatch}, resumable like {@link files.uploadStaged}. */
+    uploadBatchStaged: (
+      t: FsPlace,
+      dir: string,
+      files: { file: Blob; rel: string }[],
+      conflict: FsConflict,
+      opts: StagedSendOpts
+    ) =>
+      sendStaged<{ saved: number; skipped: number; paths: string[] }>(
+        t,
+        (staged) => fsUrl(t, "/upload-batch", new URLSearchParams({ dir, conflict, staged })),
+        batchBody(files),
+        opts
+      ),
     /** Before a batch: which of `paths` (under `dir`) are taken, and whether a batch can go there. */
     uploadCheck: (t: FsPlace, dir: string, paths: string[]) =>
       request<{ taken: string[]; batch: boolean }>(fsUrl(t, "/upload-check"), {
@@ -3356,6 +3521,32 @@ export const api = {
     /** DELETE /api/me/git/ssh-key?id= — one key by its id (a named one). */
     removeKeyById: (id: string) =>
       request<GitIdentity>(`/me/git/ssh-key?id=${encodeURIComponent(id)}`, { method: "DELETE" }),
+    /**
+     * POST /api/me/git/ssh-key/import — a private key the user already has
+     * (the file's text); `sign` signs commits with it at once, `replace`
+     * over a signing key they set themselves. Only its public half returns.
+     */
+    importKey: (body: { privateKey: string; name?: string; sign?: boolean; replace?: boolean }) =>
+      request<GitIdentity & { imported: GitSshKey | null; signError: ApiErrorBody | null }>(
+        "/me/git/ssh-key/import",
+        { method: "POST", body: JSON.stringify(body) }
+      ),
+    /**
+     * PUT /api/me/git/signing — the account-wide setting: sign every commit
+     * with key `key` (its id), or stop (null); `clearForeign` also takes out a
+     * signing setup the user made themselves (their key file stays).
+     */
+    setSigning: (key: string | null, replace = false, clearForeign = false) =>
+      request<GitIdentity>("/me/git/signing", {
+        method: "PUT",
+        body: JSON.stringify(clearForeign ? { key, replace, clearForeign } : { key, replace }),
+      }),
+    /** PUT /api/me/git/signing/lane — sign ONE workspace's commits with `key`, or stop (null). */
+    setLaneSigning: (laneId: number, key: string | null) =>
+      request<GitIdentity>("/me/git/signing/lane", {
+        method: "PUT",
+        body: JSON.stringify({ laneId, key }),
+      }),
     /** PUT /api/me/git/ssh-terminal — use the key for git typed in the account's terminal. */
     setTerminalSsh: (on: boolean) =>
       request<GitIdentity>("/me/git/ssh-terminal", { method: "PUT", body: JSON.stringify({ on }) }),
@@ -3591,6 +3782,14 @@ export const api = {
         method: "PUT",
         body: JSON.stringify({ enabled }),
       }),
+    /** GET /api/ai-tools/member-policy - what members' Claude may run (server mode, S3). */
+    memberPolicy: () => request<MemberPolicyState>("/ai-tools/member-policy"),
+    /** PUT /api/ai-tools/member-policy - an admin's switch. */
+    setMemberPolicy: (allowTests: boolean) =>
+      request<MemberPolicyState>("/ai-tools/member-policy", {
+        method: "PUT",
+        body: JSON.stringify({ allowTests }),
+      }),
     /** POST /api/ai-tools/refresh - re-read the login shell's PATH and re-detect. */
     refresh: () => request<AiToolsView>("/ai-tools/refresh", { method: "POST" }),
     /** PUT /api/ai-tools/:id - enable/disable a tool, make it the default, or set its default model ("" clears). */
@@ -5083,6 +5282,13 @@ export interface ArtifactCandidate {
 }
 
 /** `GET /api/ai-tools/omp-sharing` — never a token. */
+export interface MemberPolicyState {
+  /** Server mode with per-user Linux accounts (S3): the only place it applies. */
+  available: boolean;
+  /** May members' Claude run test runners and container commands? Off by default. */
+  allowTests: boolean;
+}
+
 export interface OmpSharingState {
   /** Server mode with per-user Linux accounts (S3): the only place it applies. */
   available: boolean;
@@ -5232,6 +5438,21 @@ export interface GitCredential {
   hasToken: true;
 }
 
+/** One SSH key of `GET /api/me/git` — its public half only. */
+export interface GitSshKey {
+  id?: string;
+  type?: "ed25519" | "rsa";
+  name?: string | null;
+  publicKey: string;
+  fingerprint: string;
+}
+
+/** An API error's `{code, message}`. */
+export interface ApiErrorBody {
+  code: string;
+  message: string;
+}
+
 /** `GET /api/me/git`: the user's own SSH key (public half only) and HTTPS logins. */
 export interface GitIdentity {
   /** `member`: the user's own Linux account (S3); `host`: the shared host account. */
@@ -5249,13 +5470,19 @@ export interface GitIdentity {
    * Every key the account holds: the default ED25519 and RSA first, then the
    * named ones (`name`; `id` = its file name); absent from an older server.
    */
-  sshKeys?: {
-    id?: string;
-    type?: "ed25519" | "rsa";
-    name?: string | null;
-    publicKey: string;
-    fingerprint: string;
-  }[];
+  sshKeys?: GitSshKey[];
+  /**
+   * Commit signing (`gpg.format ssh` + `user.signingkey` + `commit.gpgsign`
+   * in `~/.gitconfig`): `on` with one of these keys (`key` = its id), `off`,
+   * or `foreign` — a signing key the user set themselves (`path`). Absent
+   * from an older server.
+   */
+  signing?: { state: "on" | "off" | "foreign"; key: string | null; path: string | null };
+  /**
+   * The workspaces whose commits are signed (an `includeIf "gitdir:…"` each):
+   * `key` = the key's id, null when its file is gone. Absent from an older server.
+   */
+  laneSigning?: { laneId: number; key: string | null }[];
   /** The terminal switch (shared by both keys); null without a key. */
   sshTerminal?: "on" | "off" | "foreign" | null;
   /**

client/src/lib/openInPreview.ts

@@ -0,0 +1,83 @@
+/**
+ * @file openInPreview.ts — the ONE rule every link in the dashboard follows
+ * (a chat's markdown link or bare URL, a terminal's link): a page served by
+ * THIS machine (`localhost`, `127.0.0.1`, `0.0.0.0`, `[::1]`) opens in the
+ * session view's Preview tab, everything else in a browser tab as before.
+ * The request travels as a window event (like `openInChanges.ts`); the
+ * Workspace page answers it only while it shows a session panel, so with no
+ * listener — another page, or a remote dashboard where "localhost" is the
+ * viewer's own machine — the link falls back to a browser tab. Also holds the
+ * URL checks the Preview tab itself uses.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+export const OPEN_IN_PREVIEW_EVENT = "agenthub:open-in-preview";
+
+/** The event's detail. `handled` is set by the listener, read by the sender. */
+export type OpenInPreview = { url: string; handled: boolean };
+
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "::1"]);
+
+/** A URL the Preview may show: http(s) only, `0.0.0.0` read as `localhost`
+ *  (a dev server prints it, a browser cannot open it), never the dashboard's
+ *  own origin (the frame would then BE the dashboard, cookies and API
+ *  included). A bare `localhost:3000` gets `http://`. Null when refused. */
+export function normalizePreviewUrl(raw: string, self = window.location.origin): string | null {
+  let text = raw.trim();
+  if (!text) return null;
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(text)) text = `http://${text}`;
+  let u: URL;
+  try {
+    u = new URL(text);
+  } catch {
+    return null;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+  if (u.username || u.password) return null;
+  if (u.hostname === "0.0.0.0") u.hostname = "localhost";
+  if (u.origin === self) return null;
+  return u.toString();
+}
+
+/** True for a page served by the machine the BROWSER runs on. */
+export function isLoopbackUrl(url: string): boolean {
+  try {
+    const u = new URL(url);
+    return (u.protocol === "http:" || u.protocol === "https:") && LOOPBACK.has(u.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** The dashboard itself is opened from this machine: only then does a
+ *  `localhost` link name the same machine the agents run on. */
+export function dashboardIsLocal(hostname = window.location.hostname): boolean {
+  return LOOPBACK.has(hostname);
+}
+
+/** Asks the open session panel to show `url`. False when nothing took it
+ *  (not a local page, a remote dashboard, no session panel). */
+export function openInPreview(url: string): boolean {
+  if (!isLoopbackUrl(url) || !dashboardIsLocal()) return false;
+  const target = normalizePreviewUrl(url);
+  if (!target) return false;
+  const detail: OpenInPreview = { url: target, handled: false };
+  window.dispatchEvent(new CustomEvent(OPEN_IN_PREVIEW_EVENT, { detail }));
+  return detail.handled;
+}
+
+/** A link click: Preview when the rule says so, else a browser tab. A
+ *  Ctrl/Cmd/Shift/middle click always keeps the browser's own behaviour. */
+export function onLinkClick(
+  e: {
+    ctrlKey: boolean;
+    metaKey: boolean;
+    shiftKey: boolean;
+    button: number;
+    preventDefault: () => void;
+  },
+  url: string
+): void {
+  if (e.ctrlKey || e.metaKey || e.shiftKey || e.button !== 0) return;
+  if (openInPreview(url)) e.preventDefault();
+}

client/src/lib/panePaste.ts

@@ -368,10 +368,15 @@ function typeRow(options: PaneMenuOption[]): number {
 /** The status line a tool's TUI shows only while a turn runs, read off its
  *  binary's own strings: Claude's and Codex's `esc to interrupt`, agy's
  *  `Thinking… (3s · esc to cancel)` — in parentheses after an ellipsis, so
- *  Claude's permission footer (`Esc to cancel · Tab to amend`) is not it. A
- *  tool missing here (omp, Cursor) has no line we know. */
+ *  Claude's permission footer (`Esc to cancel · Tab to amend`) is not it.
+ *  Claude ≥ 2.1.3xx keeps `esc to interrupt` only in its footer, which a
+ *  narrow pane, a tip or a notice replaces, so its spinner line counts too:
+ *  a verb, an ellipsis and the turn's time in parentheses
+ *  (`✶ Skedaddling… (41s · ↓ 2.8k tokens)`) — the line a finished turn leaves
+ *  (`✻ Cooked for 1m 2s`) has neither. A tool missing here (omp, Cursor) has
+ *  no line we know. */
 export const BUSY_LINE: Readonly<Record<string, RegExp>> = {
-  claude: /\besc to interrupt\b/i,
+  claude: /\besc to interrupt\b|…\s*\(\s*\d+[smh]\b/i,
   codex: /\besc to interrupt\b/i,
   antigravity: /…\s*\([^)]*\besc to cancel\)/i,
 };

client/src/lib/types.ts

@@ -1971,6 +1971,10 @@ export interface WSMessage {
   /** ISO timestamp the server broadcast this message (not necessarily the
    *  same instant the underlying event occurred). */
   timestamp: string;
+  /** Server mode, an admin/analyst's session/agent/event frames only: whether
+   *  the session is their OWN (they also get every other user's). Absent for a
+   *  developer (who only ever gets their own) and in local mode. */
+  mine?: boolean;
 }
 
 // ───── Session stats ─────

client/src/lib/uploadJobs.ts

@@ -9,6 +9,8 @@
  * kept in localStorage (refreshed every ~2 s), and the next page load shows
  * a record that stopped being refreshed as an interrupted upload until it is
  * dismissed. A fresh record belongs to another open tab and is left alone.
+ * A dashboard RESTART is not an interruption: the upload is sent in parts
+ * (`api.files.uploadStaged`) and the job shows `waiting` until it resumes.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -25,6 +27,8 @@ export interface UploadJob {
   sent: number;
   bytes: number;
   state: "running" | "stopping" | "interrupted";
+  /** The dashboard is away (a restart): the upload waits and then resumes. */
+  waiting?: boolean;
 }
 
 type Stored = UploadJob & { beat: number };
@@ -115,7 +119,8 @@ export function beginUpload(init: { folder: string; total: number; bytes: number
   return {
     id,
     signal: ctrl.signal,
-    update: (patch: Partial<Pick<UploadJob, "name" | "done" | "sent">>) => set(id, patch),
+    update: (patch: Partial<Pick<UploadJob, "name" | "done" | "sent" | "waiting">>) =>
+      set(id, patch),
     end: () => {
       controllers.delete(id);
       uploads = uploads.filter((u) => u.id !== id);

client/src/lib/wheelReports.ts

@@ -0,0 +1,76 @@
+/**
+ * @file wheelReports.ts — turns a browser wheel event into the number of SGR
+ * wheel reports a terminal pane gets, in proportion to how far the finger or
+ * the wheel moved, the way a native terminal does.
+ *
+ * xterm.js sends ONE report per wheel event whatever its size, and damps a
+ * touchpad's pixel deltas ×0.3 before it counts even that one — a touchpad
+ * swipe crawled. In our panes every report moves a fixed stretch (Claude's
+ * `CLAUDE_CODE_SCROLL_SPEED`, tmux's copy-mode `WHEEL_LINES`), so a report is
+ * sent per `LINES_PER_REPORT` rows of travel: a touchpad scrolls 1:1 with the
+ * finger, and a wheel notch always sends at least one. `SCROLL_SPEED` then
+ * slows both down (the user asked for 30 % less): a touchpad's travel is
+ * scaled, and a notch's reports are carried as a fraction, rounded, so the
+ * first notch still moves and the average comes out at that share.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+/** Rows one report scrolls in a Claude pane (server/lib/pty-run.js CLAUDE_SCROLL_SPEED). */
+export const LINES_PER_REPORT = 5;
+
+/** Share of the travel a pane scrolls (0.7 = 30 % slower than 1:1). */
+export const SCROLL_SPEED = 0.7;
+
+/** A pixel delta this large or larger is a wheel notch, not a touchpad step (xterm.js's own cut). */
+const NOTCH_PX = 50;
+
+const DOM_DELTA_PIXEL = 0;
+const DOM_DELTA_LINE = 1;
+const DOM_DELTA_PAGE = 2;
+
+export interface WheelState {
+  /** Touchpad travel not yet sent, in rows (signed). */
+  partial: number;
+  /** Wheel-notch reports owed but not sent yet (signed, a fraction). */
+  notch?: number;
+  /** Direction of the last notch (the carry above may round to either sign). */
+  notchDir?: number;
+}
+
+/**
+ * Signed report count for `ev` — negative scrolls up. `rowPx` is one row's
+ * height on screen (CSS scale included), `rows` the terminal's height.
+ */
+export function wheelReports(
+  state: WheelState,
+  ev: Pick<WheelEvent, "deltaY" | "deltaMode">,
+  rowPx: number,
+  rows: number
+): number {
+  if (!ev.deltaY || !(rowPx > 0)) return 0;
+  const sign = ev.deltaY < 0 ? -1 : 1;
+  if (ev.deltaMode === DOM_DELTA_PIXEL && Math.abs(ev.deltaY) < NOTCH_PX) {
+    // Touchpad: carry the remainder, so slow swipes still add up.
+    if (Math.sign(state.partial) === -sign) state.partial = 0; // turned around
+    state.partial += (ev.deltaY / rowPx) * SCROLL_SPEED;
+    const n = Math.trunc(state.partial / LINES_PER_REPORT);
+    state.partial -= n * LINES_PER_REPORT;
+    return n;
+  }
+  // A notch (or a fast flick): at least one report, more for a long one.
+  state.partial = 0;
+  if (state.notchDir !== sign) state.notch = 0; // turned around
+  state.notchDir = sign;
+  const lines =
+    ev.deltaMode === DOM_DELTA_LINE
+      ? ev.deltaY
+      : ev.deltaMode === DOM_DELTA_PAGE
+        ? ev.deltaY * rows
+        : ev.deltaY / rowPx;
+  const owed =
+    (state.notch ?? 0) +
+    sign * Math.max(1, Math.round(Math.abs(lines) / LINES_PER_REPORT)) * SCROLL_SPEED;
+  const n = sign * Math.round(Math.abs(owed));
+  state.notch = owed - n;
+  return n;
+}

client/src/pages/SettingsHub.tsx

@@ -72,6 +72,7 @@ import { AiToolsSettings } from "../components/settings/AiToolsSettings";
 import { AgentInstructionsSettings } from "../components/settings/AgentInstructionsSettings";
 import { SessionDefaultsSettings } from "../components/settings/SessionDefaultsSettings";
 import { ArtifactsHubSettings } from "../components/settings/ArtifactsHubSettings";
+import { MemberPolicySettings } from "../components/settings/MemberPolicySettings";
 import { ToolProfilesSettings } from "../components/settings/ToolProfilesSettings";
 import { PoolAccountSettings } from "../components/settings/PoolAccountSettings";
 import { OmpSharingSettings } from "../components/settings/OmpSharingSettings";
@@ -317,6 +318,8 @@ export function SettingsHub({ section }: { section?: string } = {}) {
           <ArtifactsHubSettings />
           {/* The host's omp login for members: server mode + S3, an admin's. */}
           <OmpSharingSettings />
+          {/* Members' test runs on this box: server mode + S3, an admin's. */}
+          <MemberPolicySettings />
         </div>
       ),
     },

client/src/pages/Workspace.tsx

@@ -141,6 +141,8 @@ import { LaneChangesPanel } from "../components/lanes/LaneChangesPanel";
 import { FileExplorer } from "../components/lanes/FileExplorer";
 import { WorkspaceContext } from "../components/lanes/WorkspaceContext";
 import { OPEN_IN_CHANGES_EVENT, type OpenInChanges } from "../lib/openInChanges";
+import { OPEN_IN_PREVIEW_EVENT, type OpenInPreview } from "../lib/openInPreview";
+import { UrlPreview } from "../components/lanes/UrlPreview";
 import { LaneGitRailCounts } from "../components/lanes/LaneGitHeader";
 import { WorkspaceHome } from "../components/lanes/WorkspaceHome";
 import { SessionReplay } from "../components/lanes/SessionReplay";
@@ -148,6 +150,8 @@ import { DestructiveLaneModal } from "../components/lanes/DestructiveLaneModal";
 
 /** localStorage key for the Changes panel's open/closed state. */
 const CHANGES_OPEN_KEY = "agenthub.workspace.changesOpen";
+/** The session panel's tab — Changes or Preview. A viewer preference. */
+const PANEL_TAB_KEY = "agenthub.workspace.panelTab";
 /** localStorage key for how wide the Changes panel is. */
 const CHANGES_SIZE_KEY = "agenthub.workspace.changesSize";
 /** localStorage key for the last width the user dragged the panel to — what
@@ -799,6 +803,25 @@ export function Workspace() {
       return false;
     }
   });
+  // The panel's two tabs: Changes (git + files) and Preview (a web page).
+  // Both stay mounted once shown (CSS), so an unsaved edit or a loaded page
+  // survives a switch.
+  const [panelTab, setPanelTab] = useState<"changes" | "preview">(() => {
+    try {
+      return window.localStorage.getItem(PANEL_TAB_KEY) === "preview" ? "preview" : "changes";
+    } catch {
+      return "changes";
+    }
+  });
+  const [previewShown, setPreviewShown] = useState(panelTab === "preview");
+  useEffect(() => {
+    if (panelTab === "preview") setPreviewShown(true);
+    try {
+      window.localStorage.setItem(PANEL_TAB_KEY, panelTab);
+    } catch {
+      /* disabled storage: the tab just forgets between visits */
+    }
+  }, [panelTab]);
   useEffect(() => {
     try {
       window.localStorage.setItem(CHANGES_OPEN_KEY, changesOpen ? "1" : "0");
@@ -1050,6 +1073,22 @@ export function Workspace() {
     window.addEventListener(OPEN_IN_CHANGES_EVENT, onOpen);
     return () => window.removeEventListener(OPEN_IN_CHANGES_EVENT, onOpen);
   }, []);
+  // A link to a local page asks for it (`openInPreview`): taken only while a
+  // session panel is on screen, so elsewhere the link opens a browser tab.
+  const [previewRequest, setPreviewRequest] = useState<{ url: string; nonce: number } | null>(null);
+  const previewHostRef = useRef(false);
+  useEffect(() => {
+    const onOpen = (e: Event) => {
+      const detail = (e as CustomEvent<OpenInPreview>).detail;
+      if (!previewHostRef.current) return;
+      detail.handled = true;
+      setChangesOpen(true);
+      setPanelTab("preview");
+      setPreviewRequest((r) => ({ url: detail.url, nonce: (r?.nonce ?? 0) + 1 }));
+    };
+    window.addEventListener(OPEN_IN_PREVIEW_EVENT, onOpen);
+    return () => window.removeEventListener(OPEN_IN_PREVIEW_EVENT, onOpen);
+  }, []);
   // Asked once: a panel reopened or moved to another tree must not replay it.
   useEffect(() => {
     if (!changesOpen) setChangesRequest(null);
@@ -1230,6 +1269,7 @@ export function Workspace() {
   // The session view (console or replay) fills the page edge to edge, like an
   // editor: no page padding, no cards, dividers between its regions.
   const sessionView = !!currentLane && !home;
+  previewHostRef.current = sessionView;
   const viewportLocked =
     sessionView || (!home && (paneHasActiveRun || (!!currentLane && changesOpen && changesFull)));
 
@@ -1567,9 +1607,25 @@ export function Workspace() {
                   className="flex h-10 shrink-0 items-center gap-1 border-b border-border px-2"
                   role="toolbar"
                 >
-                  <span className="px-1 text-xs font-medium text-fg-secondary">
-                    {tLanes("panel.changes")}
-                  </span>
+                  <div role="tablist" className="flex items-center gap-0.5">
+                    {(["changes", "preview"] as const).map((tab) => (
+                      <button
+                        key={tab}
+                        type="button"
+                        role="tab"
+                        data-testid={`panel-tab-${tab}`}
+                        aria-selected={panelTab === tab}
+                        onClick={() => setPanelTab(tab)}
+                        className={`rounded-md px-2 py-1 text-xs font-medium transition-colors ${
+                          panelTab === tab
+                            ? "bg-surface-4 text-fg-primary"
+                            : "text-fg-muted hover:text-fg-primary"
+                        }`}
+                      >
+                        {tLanes(tab === "changes" ? "panel.changes" : "panel.preview")}
+                      </button>
+                    ))}
+                  </div>
                   {/* The opened session's analysis page — a page of its own. */}
                   <button
                     type="button"
@@ -1652,7 +1708,22 @@ export function Workspace() {
                     <PanelRightClose className="h-4 w-4" />
                   </button>
                 </div>
-                <div className="flex min-h-0 flex-1 flex-col px-3 pt-2">
+                {previewShown && (
+                  <div
+                    className={panelTab === "preview" ? "flex min-h-0 flex-1 flex-col" : "hidden"}
+                  >
+                    <UrlPreview
+                      laneId={currentLane.id}
+                      ports={currentLane.ports ?? {}}
+                      request={previewRequest}
+                    />
+                  </div>
+                )}
+                <div
+                  className={
+                    panelTab === "changes" ? "flex min-h-0 flex-1 flex-col px-3 pt-2" : "hidden"
+                  }
+                >
                   {panelAt &&
                     [
                       ...(showRoot

client/src/pages/__tests__/Workspace.test.tsx

@@ -1053,7 +1053,28 @@ describe("split panes", () => {
     const user = userEvent.setup();
     await user.click(screen.getByTestId("pane-split-right-1"));
     await user.click(screen.getByTestId("pane-split-new-right-1-claude"));
-    expect(api.lanes.action).toHaveBeenCalledWith(1, "start", { slot: "auto", prompt: "" });
+    expect(api.lanes.action).toHaveBeenCalledWith(1, "start", {
+      slot: "auto",
+      prompt: "",
+      permissionMode: "auto",
+    });
+  });
+
+  it("a new AI pane starts in the account's Session defaults (bypass included)", async () => {
+    localStorage.setItem("agenthub.permissionMode", "bypassPermissions");
+    lanesToReturn = lanesToReturn.map((l) => ({ ...l, tool: "claude" }));
+    withRuns([live(0), live(1)]);
+    await open("/workspace?lane=1&run=agenthub-lane-1");
+    await ctrlClick(screen.getByTestId("console-tab-1"));
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("pane-split-right-1"));
+    await user.click(screen.getByTestId("pane-split-new-right-1-claude"));
+    expect(api.lanes.action).toHaveBeenCalledWith(1, "start", {
+      slot: "auto",
+      prompt: "",
+      permissionMode: "bypassPermissions",
+    });
+    localStorage.removeItem("agenthub.permissionMode");
   });
 
   it("with one pane, the split menus sit beside Tools and split it", async () => {

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -7316,7 +7316,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                 <span
                   class="text-status-warning/90"
                 >
-                  UI build v2.8.53 (rebuild client to match)
+                  UI build v2.8.70 (rebuild client to match)
                 </span>
               </p>
             </div>

docs/LANES.md

@@ -416,6 +416,7 @@ The dashboard web UI merges workspaces and runs into a single **Workspace** page
 - **Tabs** — the session view's console is a tab bar (`client/src/components/run/ConsoleTabs.tsx`) over the workspace's live tmux sessions — at most ten, its slots 0–9: slot 0 is the workspace's `agenthub-lane-<id>` (its `run_id`), slots 1–9 are `agenthub-lane-<id>-<slot>`. Every tab is a **combo**: a group of one to four split panes, each session in exactly one tab (`PaneGroups` in `client/src/lib/paneLayout.ts`). A one-pane tab shows its AI tool's icon and name (or **Terminal**); a combo tab shows every pane's icon and name, and the most urgent state dot. The active tab is the one on screen and its focused pane is the URL's `?run=`, so the Changes panel and Analyst follow it. A click shows a tab; **Ctrl/Cmd+click** on a one-pane tab or a `+` item brings it into the tab on screen, in the same order as a join below (a full tab — four panes — opens it as a tab of its own instead), and a one-pane tab dragged onto a pane joins that tab there. Any tab drags along the bar to reorder it; a pane's header dragged onto the bar takes that pane out into a tab of its own at that place. Dropped on the MIDDLE of another tab (it highlights), a tab — or a pane's header — joins that tab instead, in a fixed order: the second pane goes to the right (left | right), the third under the right pane, the fourth under the left pane (2×2) — the new pane always splits the BIGGEST one by the tree's shape (dragged dividers ignored, a tie goes to the later pane), so a three-pane tab of any shape fills its one missing quarter; a drop that would pass four panes reorders instead (`joinGroup`). A pane drag (a pane's header, or a one-pane tab) held over another tab for 0.6 s opens that tab (`SPRING_MS`), so the pane can be dropped on any edge of that tab's panes instead of the fixed join order; on a bar wider than the screen, dragging near either end scrolls it. Every live session stays mounted and those of other tabs are hidden with CSS, so switching tabs never drops a terminal. A tab's **×** stops every session in it (`DELETE /api/run/<runId>`, after a confirm when one is an AI tool); with no tab left it moves to the home. The **+** menu opens a new tab in the first free slot, which the server picks (`slot: "auto"`, under the workspace lock): **New terminal** (your own default shell in the workspace folder — `POST /api/lanes/:id/start {slot, shell: true}`, recorded as tool `shell`; it is not an agent, so the workspace's `run_id`/`status` are left alone), each installed, enabled AI tool (started bare, on its default model, no prompt), and **Agent settings…** (Settings → Agents). With ten sessions open **+** is disabled. EVERY tab is bound to the sidebar's selection — unless Settings → Appearance → **Tabs from every workspace** is on (`agenthub.workspace.allTabs`, `client/src/lib/workspaceTabs.ts`, synced to the account): then the bar holds every workspace's live sessions, each tab named `<workspace> · <session>`, a combo may mix workspaces, and focusing a pane selects its workspace (`?lane=` follows `?run=`, so the Changes panel and the sidebar follow too). Those tabs are stored once, under `all` in `agenthub.workspace.paneLayout`, their leaves `paneKey`s (lane id × 10 + slot); a split's **New terminal** starts in the target pane's own workspace. A tab has no header of its own (no title, no **Active runs** list, no **New run**): other sessions are opened from the sidebar or the home's Recents. (The old fixed 1/2/4 split layout and its `agenthub.workspace.splitView` key are gone; **Split panes** replaces them.) **Settings** opened on a workspace — the sidebar's Settings, the `+` menu's Agent settings, any Settings link inside it — is one more tab at the bar's end (`?settings=<section>` beside `lane` and `run`, `client/src/lib/settingsLink.ts`): the Settings pages (`SettingsHub` with a `section`), shown instead of the panes, which stay mounted behind them, kept until the tab's X and reopened on the section it was on. Off a workspace a Settings link still opens the `/settings` page.
 
 - **Split panes** — the console splits like VS Code (`client/src/components/run/PaneGrid.tsx`, model in `client/src/lib/paneLayout.ts`): one binary tree of splits PER TAB, each side by side or stacked at a ratio, whose leaves are the workspace's slots — at most four panes in a tab, a session never shown twice. **Ctrl/Cmd+click** a one-pane tab, a `+` item or a sidebar session row brings it into the tab on screen at the 2×2 grid's next place — the same order as a tab join, whichever pane is focused (the intent rides on the navigation's state, never in the URL); with more than one pane each gets a slim header: **drag** it (or a tab) onto another pane — its edge splits there, its middle swaps the two (a session from another tab takes the pane's place and that one moves to a tab of its own) —; while the drag lasts the moved pane is dimmed, the drag shows a small chip with its name, and the drop preview says what will happen (*Place on the left*, *Swap places*…, `dropAction`), its **▾** shows another live session in it (swapping with the pane that showed it), **Split right / Split down** puts a not-shown session or a **New terminal** beside it, its **⤡** takes the pane out of this tab into a tab of its own (its session keeps running), and its **×** (also in the header's right-click menu) stops just that pane's session — the same `DELETE /api/run/<runId>` and AI-tool confirm as a tab's **×** — without taking it out first. A session dropped or swapped in from another tab leaves that tab. Dividers drag (or move by arrow keys) between 10% and 90%. Clicking in (or tabbing into) a pane focuses it, `?run=` follows — so the right panel, Analyst and the sidebar read the focused session — and the keyboard goes with it: only the focused pane's terminal takes it when it appears. A pane closes when its terminal reports that its session ended (exited, closed from another browser); the run list itself only prunes a remembered layout on a workspace's first read, and a pane opened here whose session never got listed — one empty read, which the server returns on any tmux error, never wipes a split. A session ending while the home or a replay is shown only closes its pane; the URL stays. The tabs and their layouts are a viewer preference kept per workspace in `localStorage` (`agenthub.workspace.paneLayout`, `{groups, active}`; a stored pre-tab single layout reads as one tab), never on the server. Every pane is an absolutely placed sibling keyed by its slot, so splitting, swapping or resizing never re-parents — and so never remounts — a live terminal; the session view itself fills the page edge to edge, its tab bar and the right panel's activity bar one header strip.
+- **Preview** — the session view's right panel has two tabs, **Changes** and **Preview** (`client/src/components/lanes/UrlPreview.tsx`). Preview shows a web page by address — before one is open, the workspace's bound ports are offered as `localhost:<port>` chips — with Reload and **Open in a browser tab**; the last address is remembered per workspace in this browser (`agenthub.preview.url.<id>`). Every link follows one rule (`client/src/lib/openInPreview.ts`): a chat link, bare URL or terminal link to `localhost`/`127.0.0.1`/`0.0.0.0`/`[::1]` opens in Preview while a session view is open and the dashboard itself is opened on this machine; any other link, and any Ctrl/Cmd click, opens a browser tab. The page runs on its own origin (the dashboard's own is refused) with no top navigation. A site that forbids embedding — YouTube, Google, most login pages — shows blank or a broken-page icon; any page not on this machine gets a strip under the address bar saying so, with **Open tab** beside it.
 - **Workspace grid** — one card per workspace, 1 column, 2 at `md`, 3 at `xl`. Each card carries the workspace id, liveness dot and status, title, declared stage and time-on-stage, the `auto:` chip when detection leads, the kind and CI tags, the working-copy facts from `GET /api/lanes/:id/git`, and the action row. The needs-you message (`needs_action`) is on the workspace list tile only — the detail card no longer repeats it as a banner.
 
 Run history is per workspace, queryable via `GET /api/run/history?laneId=<n>`.
@@ -530,7 +531,7 @@ the Changes panel carries the per-repo git **writes** the dashboard offers (`POS
 | **Pull** | `git pull --ff-only` | the branch has diverged (it reports, never merges) |
 | **Push** (labelled **Publish branch** while the branch has no upstream) | `git push -u origin HEAD` | the remote rejects it |
 | **Publish…** (only when the repo has NO remote) | `git remote add origin -- <url>`, then `git push -u origin HEAD`; `origin` is removed again if the push fails | the repo has no commit yet, already has a remote, or the URL is not `https://` (no `user:token@`), `ssh://` or `user@host:path` |
-| **Branch** → **Switch branch** | `git switch …`; with uncommitted changes it first asks: **Bring my changes** (`changes: "carry"`, a plain `git switch`) or **Shelve and switch** (`changes: "shelve"`) | another worktree holds that branch; **Bring my changes** when git would overwrite a carried file (the files are listed and **Shelve and switch** offered instead) |
+| **Branch** → **Switch branch** | the list is a combobox: it opens with a **Search branches…** box focused, typing narrows the local and remote branches to names containing the text, ↑/↓ move, Enter picks, Esc closes (#88 — every `Select` longer than 8 options gets the same search box); `git switch …`; with uncommitted changes it first asks: **Bring my changes** (`changes: "carry"`, a plain `git switch`) or **Shelve and switch** (`changes: "shelve"`) | another worktree holds that branch; **Bring my changes** when git would overwrite a carried file (the files are listed and **Shelve and switch** offered instead) |
 | **Create & switch** | `git switch -c <name>` — uncommitted changes come along (the default on Enter while the tree is dirty) | the branch already exists |
 | **Create** | `git branch <name>` — never switches | the branch already exists |
 | **Delete** | `git branch -d <name>` | it is protected (`main`, `master`, `development`, `develop`), current, held by another worktree, or has unmerged commits |

docs/SERVER-MODE.md

@@ -188,7 +188,9 @@ Workspaces made before server mode, or by the host account, have none.
   load, memory and swap, every real disk (HDD or SSD, how full; the one
   holding the users' homes is marked), any NVIDIA GPU. Each user's live
   share of it is a **Users · CPU / RAM now** card on the same tab (a tile per
-  user, their busiest processes on click; their home share stays in
+  user, their busiest processes on click; on hover, for an
+  admin or analyst — from `GET /api/users` — their role, $ spent today,
+  workspaces, sessions and last sign-in; their home share stays in
   Administration's users table), and the processes of no user are listed apart — CPU % of the whole machine (100 % = every core busy) and
   resident memory over a 1 s `/proc` sample, a process count, the busiest
   processes by their kernel name (never argv or env), and their home's size
@@ -886,7 +888,7 @@ What runs as the member, and how:
   - In a member's folder, git and `gh` run as `sudo -n -u ah-<name> git …`, so git's own ownership check passes and every file stays the member's.
   - The editor and `.gitignore` saves go through `/opt/agenthub/libexec/write-as`.
   - A file uploaded in the Files tab (`POST /api/lanes/:id/git/upload`) is written the same way, AS the member through `write-as` (content on stdin), and only as a NEW file in an existing folder of the workspace — never over an existing name, never into `.git`, never a home dot folder, at most 25 MB. With **Download** on a file (`GET /api/lanes/:id/git/download`, read like any member file below, up to 512 MB) this is how a member with no SSH or `scp` to the host moves files in and out of their own folder; both work in a folder that is not a git repo.
-  - AgentHub's stored git logins are never handed to a member's git, and a password typed in the git bar goes into the member's OWN store (below) for that one call — through `write-as`'s stdin, never sudo's argv or env — and out again unless "remember" was ticked; a store that cannot be read is never rewritten (`409 ESTOREUNREADABLE`). The member keeps their OWN identity in Settings → Git → **Your git identity** (`/api/me/git`): a commit author (`user.name`/`user.email` in their `~/.gitconfig` — commits fail without one; a new member has none), SSH keys AgentHub makes for them (an ED25519 and/or an RSA one — AWS CodeCommit takes only RSA) and HTTPS logins, both under `~/.config/agenthub/` in their home, written as them by `write-as` (0600). Add workspace → **Clone** (`POST /api/lanes/clone`) clones as them with it and writes it into the clone's own config (`core.sshCommand` / `credential.helper=store --file=…`), so the git bar and their agents' pushes in that repo use it too. A plain `git` they type themselves in a pane reads none of that, so making the key also sets `core.sshCommand` in their `~/.gitconfig` (the key first, then `~/.ssh/id_*`; a switch under the key, issue #82) — unless they already set their own, which is left alone. The SSH keys are shown one TAB per kind of host, each with only its own steps: **GitHub · GitLab** (ED25519, for Gitea and Bitbucket too) and **AWS CodeCommit** (RSA: copy → upload in IAM → paste the SSH key ID `APKA…` — saved for every region at once, no region to pick), then **Other hosts** (advanced); a tab's **Add another key** makes one more key of that kind at once (named `aws-2`, `aws-3`… / `git-2`…) as its own card below, with the same steps (an AWS one's step 3 saves its key ID under the key's name, tied to that key — a clone of the plain AWS URL tries it; a GitHub one's ties the key to its host — clone `ssh://<name>/<org>/<repo>.git`); it opens on the AWS tab when only an RSA key exists. The terminal switch sits under the tabs. The key ID (or another host's user) is saved as `url."ssh://<user>@<host>/".insteadOf "ssh://<host>/"` in the same `~/.gitconfig`, so the plain `git clone ssh://git-codecommit.<region>.amazonaws.com/v1/repos/<repo>` works in a pane and in Clone — and Clone tries every CodeCommit login saved (the region's own first, then each other account's key — an IAM key ID works in every region of its AWS account), keeping the one that logs in in the clone's `origin`. A login typed in the Clone dialog goes to their store through `write-as`'s stdin, never sudo's argv or env, and is removed again after the clone unless "remember" was ticked.
+  - AgentHub's stored git logins are never handed to a member's git, and a password typed in the git bar goes into the member's OWN store (below) for that one call — through `write-as`'s stdin, never sudo's argv or env — and out again unless "remember" was ticked; a store that cannot be read is never rewritten (`409 ESTOREUNREADABLE`). The member keeps their OWN identity in Settings → Git → **Your git identity** (`/api/me/git`): a commit author (`user.name`/`user.email` in their `~/.gitconfig` — commits fail without one; a new member has none), SSH keys AgentHub makes for them (an ED25519 and/or an RSA one — AWS CodeCommit takes only RSA) and HTTPS logins, both under `~/.config/agenthub/` in their home, written as them by `write-as` (0600). Add workspace → **Clone** (`POST /api/lanes/clone`) clones as them with it and writes it into the clone's own config (`core.sshCommand` / `credential.helper=store --file=…`), so the git bar and their agents' pushes in that repo use it too. A plain `git` they type themselves in a pane reads none of that, so making (or importing) a key also sets `core.sshCommand` in their `~/.gitconfig` (the key first, then `~/.ssh/id_*`; a switch under the key, issue #82) — unless they already set their own, which is left alone. **Commit signing** sits under the author: one picker signs every commit (terminal, Changes panel, agents) with one of their keys — `gpg.format ssh`, `user.signingkey` = that key's private file, `commit.gpgsign true` in their `~/.gitconfig`; a signing key they set up themselves is replaced only after a confirm — and **Import a key you have** takes a key file or paste (OpenSSH or PEM, ed25519 or RSA ≥ 2048, no passphrase: a dashboard commit has nowhere to type one) into the same `~/.config/agenthub/ssh/` as a named key (`signing`, `signing-2`…), written as them, and by default signs with it at once; only its public half is shown again. The SSH keys are shown one TAB per kind of host, each with only its own steps: **Git (GitHub, GitLab, Gitea, Backlog…)** (ED25519, for Bitbucket too) and **AWS CodeCommit** (RSA: copy → upload in IAM → paste the SSH key ID `APKA…` — saved for every region at once, no region to pick), then **Other hosts** (advanced); a tab's **Add another key** makes one more key of that kind at once (named `aws-2`, `aws-3`… / `git-2`…) as its own card below, with the same steps (an AWS one's step 3 saves its key ID under the key's name, tied to that key — a clone of the plain AWS URL tries it; a GitHub one's ties the key to its host — clone `ssh://<name>/<org>/<repo>.git`); it opens on the AWS tab when only an RSA key exists. The terminal switch sits under the tabs. The key ID (or another host's user) is saved as `url."ssh://<user>@<host>/".insteadOf "ssh://<host>/"` in the same `~/.gitconfig`, so the plain `git clone ssh://git-codecommit.<region>.amazonaws.com/v1/repos/<repo>` works in a pane and in Clone — and Clone tries every CodeCommit login saved (the region's own first, then each other account's key — an IAM key ID works in every region of its AWS account), keeping the one that logs in in the clone's `origin`. A login typed in the Clone dialog goes to their store through `write-as`'s stdin, never sudo's argv or env, and is removed again after the clone unless "remember" was ticked.
 - **Files a pane reads.** These are written into `~/.agenthub/handoff/` AS the member (`write-as`). The dashboard never writes, changes or deletes anything in a member's home itself: the member could have swapped the name for a link. The files are:
   - the workspace prompt and its context files;
   - the AI Proxy settings: no key, only that pane's own token for the gateway;
@@ -1154,6 +1156,52 @@ The same re-run installs `agenthub-provision delete`, behind the Users page's
 **Delete user**: until then a delete answers `502 EPROVISION` ("unknown
 action: delete") and changes nothing.
 
+The same re-run (v2.8.68) keeps members from freezing the box — on 11-02
+some 36 open sessions plus test runs filled RAM and the 4 GB swap on a slow
+disk, and only a hard reset brought it back. The box is for writing code;
+tests run on each member's own machine:
+
+- **Memory.** `agenthub.service` gets `MemoryMax=85%`, `MemorySwapMax=1G`,
+  `OOMPolicy=continue` and `OOMScoreAdjust=-100`. The cgroup holds the server
+  AND every member pane, so memory runs out inside the unit first and the
+  kernel kills one process there by `oom_score_adj`: every command a member's
+  Claude runs is 1000 (`CLAUDE_CODE_SHELL_PREFIX=/opt/agenthub/libexec/tool-run`,
+  which also tells Claude why its command died), a Terminal tab 800, an AI
+  session 300, the dashboard and tmux -100. A test run dies; the session
+  holding the conversation does not. Codex runs its commands without that
+  wrapper, so its commands sit at 300 beside it.
+- **CPU and disk.** `pane-launch` starts every member pane at `nice 10` and
+  best-effort IO priority 7 (the nice cannot be taken back without root), and
+  defaults `VITEST_MAX_THREADS` / `VITEST_MAX_FORKS` to 2.
+- **No tests or containers from Claude.** A synchronous `PreToolUse` hook
+  (`/opt/agenthub/app/scripts/member-guard.js`, Bash only, `ah-*` accounts
+  only) denies `vitest`, `jest`, `phpunit`, `pest`, `pytest`, `npm test`,
+  `npm run test:*`, `php artisan test`, `go test`, `cargo test`, `docker`,
+  `podman`, … and tells Claude to leave testing to the member's machine.
+  A person typing a command in a Terminal tab, and Codex, are not covered.
+  An admin can allow them again with **Settings → AI tools → Tests on this
+  server** (`PUT /api/ai-tools/member-policy` `{allowTests}`, kept in
+  `/opt/agenthub/app/member-policy.json`, no file = blocked); it takes effect
+  at members' next Bash call, no restart.
+- **At most 4 AI sessions per member at once** (`MAX_AI_SESSIONS=<n>` in
+  `/etc/agenthub/server.conf`, `0` = no limit). Counted from the account's
+  running processes (`server/lib/ai-procs.js`: `claude`, `codex`, `agy`,
+  `cursor-agent`, `omp`, a nested one counted once), so a `claude` typed into
+  a Terminal tab counts and the tab itself does not. A new pane past the
+  limit answers `429 ESESSIONLIMIT`; a session started by hand past it has
+  every prompt refused by the guard's `UserPromptSubmit` until another one
+  ends. The host account (admins) is not limited.
+
+The memory caps apply to the running unit at once (the re-run does
+`daemon-reload`); `OOMScoreAdjust`, the session limit on new panes and the
+guard script in `/opt/agenthub/app` arrive with the next restart
+(`sudo -n /usr/bin/systemctl restart --no-block agenthub.service` — panes
+survive, `KillMode=process`). Panes started before the re-run keep their old
+priority. Check with
+`systemctl show agenthub.service -p MemoryMax,MemorySwapMax,OOMPolicy`
+and, in a new member pane, `ps -o ni= -p $$; cat /proc/self/oom_score_adj;
+echo $CLAUDE_CODE_SHELL_PREFIX`.
+
 ### Deleting a user
 
 Users page → Edit → **Delete user** (the admin's own password, then a red

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.8.53",
+  "version": "2.8.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.8.53",
+      "version": "2.8.70",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.8.53",
+  "version": "2.8.70",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },

scripts/member-guard.js

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+/**
+ * @file member-guard.js
+ * @description Server mode, one Linux user per account (S3): the members'
+ * SYNCHRONOUS Claude Code hook, from /etc/claude-code/managed-settings.json
+ * (install-system.sh), run AS the member from /opt/agenthub/app. The box is
+ * shared and small, so it is for writing code only:
+ *
+ *  - `PreToolUse` (matcher Bash): denies a test run or a container command
+ *    (`isHeavy`) — the member commits, pulls the branch on their own machine
+ *    and runs it there. Claude gets the reason and stops trying. An admin
+ *    can allow them again (Settings → AI tools, server/lib/member-policy.js).
+ *  - `UserPromptSubmit`: a member runs at most `MAX_AI_SESSIONS` AI sessions
+ *    at once (server/lib/ai-procs.js). The dashboard refuses a pane past the
+ *    limit itself (ESESSIONLIMIT); this catches a `claude` typed into a
+ *    Terminal tab, by refusing every prompt of a session that is not among
+ *    the account's oldest `limit` ones.
+ *
+ * Only `ah-*` accounts are guarded (the host is an admin's). Fail-open like
+ * every AgentHub hook: any error lets the call through. A person's own
+ * terminal commands and Codex (whose hooks are opt-in) are not covered.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const os = require("node:os");
+const path = require("node:path");
+
+const procs = require(path.join(__dirname, "..", "server", "lib", "ai-procs.js"));
+const policy = require(path.join(__dirname, "..", "server", "lib", "member-policy.js"));
+
+/** Test runners and container tools, by the program a command segment runs. */
+const HEAVY_BINS = new Set([
+  "vitest",
+  "jest",
+  "mocha",
+  "ava",
+  "karma",
+  "playwright",
+  "cypress",
+  "phpunit",
+  "pest",
+  "paratest",
+  "pytest",
+  "py.test",
+  "tox",
+  "nox",
+  "rspec",
+  "ctest",
+  "nextest",
+  "docker",
+  "docker-compose",
+  "podman",
+  "podman-compose",
+  "nerdctl",
+  "buildah",
+  "kind",
+  "minikube",
+  "k3d",
+]);
+/** Wrappers that run the command after them. */
+const PASS_THROUGH = new Set([
+  "sudo",
+  "env",
+  "time",
+  "nice",
+  "ionice",
+  "timeout",
+  "npx",
+  "bunx",
+  "pnpx",
+  "exec",
+  "command",
+  "xvfb-run",
+  "stdbuf",
+]);
+const TEST_SCRIPT = /^(test|tests|e2e|spec|unit|integration)([:._-].*)?$/;
+
+/** The words of one command segment, wrappers and env assignments dropped. */
+function words(segment) {
+  const w = segment
+    .trim()
+    .split(/\s+/)
+    .map((x) => x.replace(/^['"]|['"]$/g, ""))
+    .filter(Boolean);
+  for (;;) {
+    while (w.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(w[0])) w.shift();
+    if (!w.length || !PASS_THROUGH.has(path.basename(w[0]))) break;
+    w.shift();
+    // a wrapper's own options and arguments (`timeout 60`, `nice -n 5`, `npx -y`)
+    while (w.length && (w[0].startsWith("-") || /^\d+[smhd]?$/.test(w[0]))) w.shift();
+  }
+  return w;
+}
+
+/** Does this one segment run tests or containers? */
+function segmentIsHeavy(segment) {
+  const w = words(segment);
+  if (!w.length) return false;
+  const bin = path.basename(w[0]);
+  const [a, b] = [w[1] || "", w[2] || ""];
+  if (HEAVY_BINS.has(bin)) return true;
+  if (["npm", "pnpm", "yarn", "bun", "composer"].includes(bin)) {
+    if (a === "t" || TEST_SCRIPT.test(a)) return true; // npm test, yarn test:unit
+    if (["run", "run-script", "exec", "x", "dlx"].includes(a)) {
+      return TEST_SCRIPT.test(b) || HEAVY_BINS.has(path.basename(b));
+    }
+    return false;
+  }
+  if (["go", "deno", "dotnet", "mvn", "mvnw", "gradle", "gradlew"].includes(bin)) {
+    return ["test", "verify", "integrationTest"].includes(a);
+  }
+  if (bin === "cargo") return a === "test" || a === "nextest";
+  if (bin === "make") return w.slice(1).some((x) => TEST_SCRIPT.test(x) || x === "check");
+  if (bin === "php" || bin === "artisan") {
+    const rest = bin === "php" ? w.slice(1) : w;
+    const i = rest.findIndex((x) => /(^|\/)artisan$/.test(x));
+    if (i !== -1 && TEST_SCRIPT.test(rest[i + 1] || "")) return true;
+    return rest.some((x) => HEAVY_BINS.has(path.basename(x)));
+  }
+  if (/^python[0-9.]*$/.test(bin)) {
+    const i = w.indexOf("-m");
+    return i !== -1 && ["pytest", "unittest", "tox", "nox"].includes(w[i + 1]);
+  }
+  return false;
+}
+
+/** Does a Bash command run tests or containers anywhere in it? */
+function isHeavy(command) {
+  if (typeof command !== "string") return false;
+  // Inner `bash -c "..."` / `sh -c '...'` bodies are checked too.
+  const inner = [...command.matchAll(/\b(?:ba|z|da)?sh\s+-l?c\s+(["'])([\s\S]*?)\1/g)].map(
+    (m) => m[2]
+  );
+  return [command, ...inner].some((c) => c.split(/&&|\|\||[;|&\n()]|\$\(|`/).some(segmentIsHeavy));
+}
+
+const DENY_REASON =
+  "AgentHub: this shared server is for writing code only — tests and containers " +
+  "(vitest, jest, phpunit, pytest, npm test, docker, …) are not run here, because " +
+  "a few of them at once freeze it for the whole team. Do not try another way to " +
+  "run them. Finish the change, tell the user which tests to run, and let them " +
+  "commit, pull the branch on their own machine and test there.";
+
+/** The admin's switch (Settings → AI tools), beside this script in the app root. */
+const testsAllowed = () =>
+  policy.read(path.join(__dirname, "..", policy.FILE)).allowTests === true;
+
+function guardTool(input, allowed = testsAllowed()) {
+  if (allowed || input.tool_name !== "Bash" || !isHeavy(input.tool_input?.command)) return;
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: DENY_REASON,
+      },
+    }) + "\n"
+  );
+}
+
+function guardPrompt() {
+  const limit = procs.sessionLimit();
+  if (!limit) return;
+  const mine = procs.sessionOf(process.pid);
+  if (mine == null) return;
+  const all = procs.sessionsOf(process.getuid());
+  const at = all.findIndex((s) => s.pid === mine);
+  if (at < limit) return; // among the oldest `limit` (or not found: let it be)
+  process.stderr.write(
+    `AgentHub: you are running ${all.length} AI sessions — at most ${limit} at once on this ` +
+      "server, and this one started past the limit. Close another session (or this one) first.\n"
+  );
+  process.exit(2);
+}
+
+function main() {
+  const event = process.argv[2];
+  let raw = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (c) => (raw += c));
+  process.stdin.on("end", () => {
+    try {
+      if (!os.userInfo().username.startsWith("ah-")) return;
+      if (event === "PreToolUse") guardTool(JSON.parse(raw || "{}"));
+      else if (event === "UserPromptSubmit") guardPrompt();
+    } catch {
+      /* fail-open */
+    }
+  });
+}
+
+if (require.main === module) main();
+
+module.exports = { isHeavy, segmentIsHeavy, words, guardTool };

scripts/server/install-system.sh

@@ -16,11 +16,13 @@
 #   /opt/agenthub/libexec/member-hook       Claude hook forwarder for members
 #   /opt/agenthub/libexec/write-as          writes in a member's home AS the member (sudo -u)
 #   /opt/agenthub/libexec/pane-launch       starts a member's pane from its launch file
+#   /opt/agenthub/libexec/tool-run          wraps each command a member's Claude runs (OOM: it dies first)
 #   /opt/agenthub/libexec/tmux-member       a member's tmux, with their running server's own binary
 #   /etc/sudoers.d/agenthub       checked with visudo before it is installed
 #   /etc/claude-code/managed-settings.json  the member hooks (never over a foreign file)
 #   /proc hidepid=invisible,gid=agenthub-proc  (now and in /etc/fstab)
-#   /etc/systemd/system/agenthub.service    reads the host-owned env file
+#   /etc/systemd/system/agenthub.service    reads the host-owned env file; caps
+#            the cgroup (server + every pane) at 85% of RAM, 1G swap
 # @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 set -euo pipefail
 
@@ -106,6 +108,7 @@ chmod 0644 /etc/agenthub/server.conf
 install -m 0755 -o root -g root "$ROOT/scripts/server/agenthub-provision.sh" /opt/agenthub/sbin/agenthub-provision
 install -m 0755 -o root -g root "$ROOT/scripts/server/write-as.sh" /opt/agenthub/libexec/write-as
 install -m 0755 -o root -g root "$ROOT/scripts/server/pane-launch.sh" /opt/agenthub/libexec/pane-launch
+install -m 0755 -o root -g root "$ROOT/scripts/server/tool-run.sh" /opt/agenthub/libexec/tool-run
 install -m 0755 -o root -g root "$ROOT/scripts/server/tmux-member.sh" /opt/agenthub/libexec/tmux-member
 
 # ── node + the hook handler, for members (host-owned: the dashboard refreshes them) ──
@@ -163,7 +166,14 @@ else
     const hook = (e) => [{ ...(["PreToolUse","PostToolUse"].includes(e) ? { matcher: "*" } : {}),
       hooks: [{ type: "command", command: `/opt/agenthub/libexec/member-hook ${e}`, timeout: 5,
         ...(["PreToolUse","PostToolUse"].includes(e) ? { async: true } : {}) }] }];
-    process.stdout.write(JSON.stringify({ hooks: Object.fromEntries(ev.map((e) => [e, hook(e)])) }, null, 2) + "\n");
+    const hooks = Object.fromEntries(ev.map((e) => [e, hook(e)]));
+    // The guard is synchronous (it decides): no test runs or containers from
+    // Claude, and at most MAX_AI_SESSIONS AI sessions per member (member-guard.js).
+    const guard = (e) => ({ type: "command", timeout: 5,
+      command: `/opt/agenthub/tools/bin/node /opt/agenthub/app/scripts/member-guard.js ${e}` });
+    hooks.PreToolUse.push({ matcher: "Bash", hooks: [guard("PreToolUse")] });
+    hooks.UserPromptSubmit.push({ hooks: [guard("UserPromptSubmit")] });
+    process.stdout.write(JSON.stringify({ hooks }, null, 2) + "\n");
   ' >"$MANAGED"
   chmod 0644 "$MANAGED"
   sha256sum "$MANAGED" >"$MANAGED_MARK"
@@ -203,6 +213,14 @@ ExecStart=/usr/bin/env \${AGENTHUB_NODE} \${AGENTHUB_ROOT}/server/index.js
 Restart=always
 RestartSec=3
 KillMode=process
+# Every member pane lives in this cgroup. Capped below RAM with little swap
+# (swap on a slow disk froze the whole box on 11-02), a runaway test run is
+# OOM-killed inside the unit — pane-launch makes panes the first pick — and
+# "continue" keeps the dashboard up when that happens.
+MemoryMax=85%
+MemorySwapMax=1G
+OOMPolicy=continue
+OOMScoreAdjust=-100
 
 [Install]
 WantedBy=multi-user.target

scripts/server/pane-launch.sh

@@ -10,7 +10,8 @@
 # the environment and execs the command; no shell ever parses a value.
 #
 # The file is NUL-separated: the number of environment entries, the
-# NAME=value entries, then the argv (none = a login shell).
+# NAME=value entries, then the argv (none = a login shell). Every pane starts
+# at a lower CPU/IO priority, Claude's commands as the kernel's first OOM pick.
 # @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 set -eu
 f=${1:?usage: pane-launch <launch file>}
@@ -22,6 +23,27 @@ for kv in "${parts[@]:1:n}"; do
   [[ "$kv" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]] || { echo "pane-launch: bad variable" >&2; exit 2; }
   export "$kv"
 done
+# A member's pane shares the 4-core box with the dashboard and every other
+# member, so it runs at a lower CPU/IO priority (a member cannot take the
+# nice back: that needs root). Memory (11-02: 36 sessions plus test runs
+# filled RAM and swap, and the box froze until a hard reset): the unit caps
+# its cgroup below RAM (install-system.sh), and inside it the kernel kills
+# by oom_score_adj — the dashboard and tmux at the unit's -100, an AI session
+# at 300, a Terminal tab at 800, and every command Claude runs at 1000
+# through CLAUDE_CODE_SHELL_PREFIX=tool-run. So a runaway command dies and
+# the session that holds the conversation is told why; a member who lowers
+# their own value can go no lower than -100.
+renice -n 10 -p $$ >/dev/null 2>&1 || true
+ionice -c 2 -n 7 -p $$ >/dev/null 2>&1 || true
+TOOL_RUN=/opt/agenthub/libexec/tool-run
+[ -x "$TOOL_RUN" ] && export CLAUDE_CODE_SHELL_PREFIX="${CLAUDE_CODE_SHELL_PREFIX:-$TOOL_RUN}"
+# Vitest ≤ 3 starts one worker per core by default and these override the
+# config; a member may set their own in the pane.
+export VITEST_MAX_THREADS="${VITEST_MAX_THREADS:-2}" VITEST_MAX_FORKS="${VITEST_MAX_FORKS:-2}"
 argv=("${parts[@]:n+1}")
-if [ ${#argv[@]} -eq 0 ]; then exec -l "${SHELL:-/bin/bash}"; fi
+if [ ${#argv[@]} -eq 0 ]; then
+  echo 800 >/proc/self/oom_score_adj 2>/dev/null || true
+  exec -l "${SHELL:-/bin/bash}"
+fi
+echo 300 >/proc/self/oom_score_adj 2>/dev/null || true
 exec "${argv[@]}"

scripts/server/tool-run.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# @file tool-run.sh
+# @description Server mode, one Linux user per account (S3): installed as
+# /opt/agenthub/libexec/tool-run and named by CLAUDE_CODE_SHELL_PREFIX in
+# every member pane (pane-launch). Claude Code runs each Bash command (and
+# hook) as `tool-run '<command string>'`. The command runs at the kernel's
+# highest OOM preference, so when memory runs out it is the command — a test
+# run, a build — that is killed, never the Claude session above it that holds
+# the conversation (pane-launch puts that one at 300). When the cgroup's OOM
+# count moved while the command ran, Claude is told why it died.
+# @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+[ $# -gt 0 ] || exec /bin/bash
+echo 1000 >/proc/self/oom_score_adj 2>/dev/null
+cg=$(sed -n 's/^0:://p' /proc/self/cgroup 2>/dev/null)
+events=/sys/fs/cgroup${cg}/memory.events
+kills() { sed -n 's/^oom_kill //p' "$events" 2>/dev/null; }
+before=$(kills)
+/bin/bash -c "$1"
+rc=$?
+if [ "$rc" -ne 0 ] && [ -n "$before" ] && [ "$(kills)" != "$before" ]; then
+  printf '\n%s\n' "AgentHub: the server ran out of memory, so a process of this command was stopped (exit $rc). This shared server is for writing code only: do not run tests, containers or other heavy jobs here — tell the user to run them on their own machine." >&2
+fi
+exit "$rc"

server/__tests__/file-explorer.test.js

@@ -4,7 +4,9 @@
  * place, across workspaces), delete into the trash and restore/purge, a
  * streamed upload into new sub-folders with every conflict policy, a batch
  * of many small files in one request (and, in a member's folder, as ONE
- * write-as `extract` of a tar that real `tar` unpacks), a zip of
+ * write-as `extract` of a tar that real `tar` unpacks), a resumable upload
+ * sent in parts and committed from the staged bytes (and a member's upload
+ * written to a hidden temp file, moved onto its name only when whole), a zip of
  * files and folders that unzips back to the same bytes — and the guards: no
  * `..`, no symlink walking out, nothing in `.git`, no secret file, the
  * workspace folder itself never moved or deleted, cross-origin refused.
@@ -293,6 +295,144 @@ describe("File Explorer", () => {
     assert.ok(!fs.existsSync(path.join(W1, "up/s.txt")));
   });
 
+  it("resumes an upload sent in parts, and writes it only once every byte is staged", async () => {
+    const staging = require("../lib/upload-staging");
+    const id = "resume-test-0000000001";
+    const data = Buffer.from("0123456789abcdefghij");
+    const part = (offset, bytes, upload = id) =>
+      request(
+        "POST",
+        `/api/lanes/${lane1}/fs/upload-part?upload=${upload}&offset=${offset}&total=${data.length}`,
+        bytes,
+        { "Content-Type": "application/octet-stream" }
+      );
+    const status = async () =>
+      (await request("GET", `/api/lanes/${lane1}/fs/upload-part?upload=${id}`)).body;
+    assert.deepEqual(await status(), { received: 0, total: null, done: false });
+    assert.equal((await part(0, data.subarray(0, 8))).body.received, 8);
+    // A part that does not start where the staged bytes end: 409 with the truth.
+    const off = await part(4, data.subarray(4, 12));
+    assert.equal(off.status, 409);
+    assert.equal(off.body.error.code, "EOFFSET");
+    assert.equal(off.body.error.received, 8);
+    // Committing early writes nothing.
+    const early = await request(
+      "POST",
+      `/api/lanes/${lane1}/fs/upload?path=res/file.bin&staged=${id}`
+    );
+    assert.equal(early.status, 409);
+    assert.equal(early.body.error.code, "EINCOMPLETE");
+    assert.ok(!fs.existsSync(path.join(W1, "res/file.bin")));
+    // A part past the end is refused.
+    assert.equal((await part(8, Buffer.alloc(13))).status, 413);
+    assert.equal((await status()).received, 8);
+    assert.equal((await part(8, data.subarray(8))).body.received, data.length);
+    const commit = () =>
+      request("POST", `/api/lanes/${lane1}/fs/upload?path=res/file.bin&staged=${id}`);
+    const done = await commit();
+    assert.equal(done.status, 201);
+    assert.deepEqual(done.body, { path: "res/file.bin" });
+    assert.deepEqual(fs.readFileSync(path.join(W1, "res/file.bin")), data);
+    // A commit whose answer was lost is answered again, never written twice.
+    fs.writeFileSync(path.join(W1, "res/file.bin"), "changed since");
+    const again = await commit();
+    assert.equal(again.status, 201);
+    assert.deepEqual(again.body, { path: "res/file.bin" });
+    assert.equal(fs.readFileSync(path.join(W1, "res/file.bin"), "utf8"), "changed since");
+    assert.deepEqual(await status(), { received: data.length, total: data.length, done: true });
+    // A taken name keeps the staged bytes for a retry with another policy.
+    const id2 = "resume-test-0000000002";
+    await part(0, data, id2);
+    const taken = await request(
+      "POST",
+      `/api/lanes/${lane1}/fs/upload?path=res/file.bin&staged=${id2}`
+    );
+    assert.equal(taken.status, 409);
+    assert.equal(taken.body.error.code, "EEXISTS");
+    const kept = await request(
+      "POST",
+      `/api/lanes/${lane1}/fs/upload?path=res/file.bin&staged=${id2}&conflict=keep`
+    );
+    assert.equal(kept.body.path, "res/file (1).bin");
+    assert.deepEqual(fs.readFileSync(path.join(W1, "res/file (1).bin")), data);
+    // A batch goes the same way.
+    const head = Buffer.from(JSON.stringify({ files: [{ path: "b1.txt", size: 2 }] }));
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(head.length);
+    const batch = Buffer.concat([len, head, Buffer.from("hi")]);
+    const id3 = "resume-test-0000000003";
+    await request(
+      "POST",
+      `/api/lanes/${lane1}/fs/upload-part?upload=${id3}&offset=0&total=${batch.length}`,
+      batch,
+      { "Content-Type": "application/octet-stream" }
+    );
+    const b = await request("POST", `/api/lanes/${lane1}/fs/upload-batch?dir=res&staged=${id3}`);
+    assert.equal(b.status, 201);
+    assert.equal(fs.readFileSync(path.join(W1, "res/b1.txt"), "utf8"), "hi");
+    // Stop: forgotten. A bad id or an unknown upload is refused, never a path.
+    assert.equal(
+      (await request("DELETE", `/api/lanes/${lane1}/fs/upload-part?upload=${id}`)).status,
+      200
+    );
+    assert.equal((await status()).received, 0);
+    assert.equal(
+      (await request("GET", `/api/lanes/${lane1}/fs/upload-part?upload=../../etc`)).status,
+      400
+    );
+    assert.equal(
+      (await request("POST", `/api/lanes/${lane1}/fs/upload?path=x&staged=nope-nope-nope-nope`))
+        .status,
+      404
+    );
+    // Uploads are per user: another user's key never sees this one.
+    assert.equal(staging.status("42", id3).received, 0);
+    assert.ok(fs.statSync(path.join(staging.root(), "local")).isDirectory());
+    for (const i of [id2, id3]) staging.drop("local", i);
+  });
+
+  it("keeps the bytes of a part cut short, caps unfinished uploads, sweeps old ones", async () => {
+    const staging = require("../lib/upload-staging");
+    const { Readable } = require("node:stream");
+    const id = "cut-short-0000000001";
+    let sent = false;
+    const cut = new Readable({
+      read() {
+        if (!sent) {
+          sent = true;
+          this.push(Buffer.from("abcd"));
+        } else setTimeout(() => this.destroy(new Error("connection reset")), 30);
+      },
+    });
+    await assert.rejects(staging.putPart("u1", id, { offset: 0, total: 10, stream: cut }));
+    assert.equal(staging.status("u1", id).received, 4);
+    const rest = Readable.from([Buffer.from("efghij")]);
+    assert.equal(
+      (await staging.putPart("u1", id, { offset: 4, total: 10, stream: rest })).received,
+      10
+    );
+    // At most MAX_OPEN unfinished uploads per user.
+    for (let i = 1; i < staging.MAX_OPEN; i++) {
+      await staging.putPart("u1", `cap-test-${String(i).padStart(10, "0")}`, {
+        offset: 0,
+        total: 5,
+        stream: Readable.from([Buffer.from("a")]),
+      });
+    }
+    await assert.rejects(
+      staging.putPart("u1", "cap-test-overflow-01", {
+        offset: 0,
+        total: 5,
+        stream: Readable.from([Buffer.from("a")]),
+      }),
+      { code: "ETOOMANY" }
+    );
+    // A day untouched: swept.
+    staging.sweep(Date.now() + staging.KEEP_MS + 60_000);
+    assert.equal(staging.status("u1", id).received, 0);
+    assert.deepEqual(fs.readdirSync(path.join(staging.root(), "u1")), []);
+  });
+
   it("zips files and folders into one download that unzips to the same bytes", async () => {
     const r = await request("GET", `/api/lanes/${lane1}/fs/zip?p=src&p=site/css/app.css`);
     assert.equal(r.status, 200);
@@ -404,6 +544,49 @@ describe("File Explorer in a member's folder (S3, run-as stubbed)", () => {
     }
   });
 
+  it("writes an upload to a hidden temp file and moves it onto the name only when complete", async () => {
+    const { Readable } = require("node:stream");
+    const prev = runAs.writeAsAsync;
+    const runs = [];
+    // write-as as a shell would run it: `cat >file` takes whatever arrived.
+    runAs.writeAsAsync = async (_a, file, args, { input } = {}) => {
+      runs.push([path.basename(file), ...args.map((a) => path.basename(a))]);
+      if (!args.length) {
+        const chunks = [];
+        for await (const c of input) chunks.push(c);
+        fs.writeFileSync(file, Buffer.concat(chunks));
+      } else if (args[0] === "move") fs.renameSync(file, args[1]);
+      else if (args[0] === "remove") fs.rmSync(file, { force: true });
+    };
+    try {
+      const out = await fx.upload(M, "up.txt", Readable.from([Buffer.from("whole")]), {
+        length: "5",
+      });
+      assert.equal(out.path, "up.txt");
+      assert.equal(fs.readFileSync(path.join(M, "up.txt"), "utf8"), "whole");
+      assert.match(runs[0][0], /^\.up\.txt\.agenthub-upload-/);
+      assert.deepEqual(runs[1].slice(1), ["move", "up.txt"]);
+      // The body ended early (a dropped connection, a dying server): nothing
+      // under the real name, and the temp file is removed.
+      runs.length = 0;
+      await assert.rejects(
+        fx.upload(M, "cut.txt", Readable.from([Buffer.from("par")]), { length: "10" }),
+        { code: "EBADBODY" }
+      );
+      assert.ok(!fs.existsSync(path.join(M, "cut.txt")));
+      assert.deepEqual(
+        fs.readdirSync(M).filter((n) => n.includes("agenthub-upload")),
+        []
+      );
+      assert.deepEqual(
+        runs.map((r) => r[1] ?? "write"),
+        ["write", "remove"]
+      );
+    } finally {
+      runAs.writeAsAsync = prev;
+    }
+  });
+
   it("says the helper needs updating instead of failing obscurely", async () => {
     runAs.writeAsCanMove = () => false;
     try {

server/__tests__/git-signing.test.js

@@ -0,0 +1,334 @@
+/**
+ * @file Tests for importing an SSH key the user already has and signing
+ * commits with it (`POST /api/me/git/ssh-key/import`, `PUT /api/me/git/signing`,
+ * `server/lib/git-identity.js`): OpenSSH and PEM keys of both types read into
+ * the same public half `ssh-keygen -y` prints, only that half returned, the
+ * private file 0600; a passphrase key, a `.pub`, an ecdsa key and the same key
+ * twice refused; a real commit signed and verified by git; a signing key the
+ * user set themselves kept unless replaced, and taken out (its file kept) on
+ * `clearForeign`; deleting the key stops signing. Per workspace
+ * (`PUT /api/me/git/signing/lane`): only that workspace's commits — and its
+ * sessions' `ah-<id>-*` worktrees — are signed, never another repo's, the
+ * user's own includes stay, and deleting the key stops that workspace's too.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const http = require("node:http");
+const { execFileSync } = require("node:child_process");
+
+const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "git-signing-"));
+process.env.DASHBOARD_DB_PATH = path.join(ROOT, "t.db");
+process.env.CLAUDE_HOME = path.join(ROOT, ".claude");
+process.env.DASHBOARD_REMOTE_SYNC_MS = "0";
+process.env.DASHBOARD_LIVENESS_PROBE = "0";
+process.env.GIT_CONFIG_NOSYSTEM = "1";
+process.env.HOME = ROOT;
+
+const { createApp } = require("../index");
+
+let app;
+let base;
+const KEYS = path.join(ROOT, "keys");
+
+function request(method, p, body) {
+  return fetch(`${base}${p}`, {
+    method,
+    headers: { "Content-Type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json().catch(() => null) }));
+}
+
+/** A key made by ssh-keygen itself: `{text, pub}` (pub = type + base64). */
+function keygen(name, args, pass = "") {
+  const file = path.join(KEYS, name);
+  execFileSync("ssh-keygen", ["-q", ...args, "-N", pass, "-C", "me@x", "-f", file]);
+  const pub = fs.readFileSync(`${file}.pub`, "utf8").split(" ").slice(0, 2).join(" ");
+  return { text: fs.readFileSync(file, "utf8"), pub };
+}
+const pubOf = (line) => line.split(" ").slice(0, 2).join(" ");
+const gitGet = (k) => {
+  try {
+    return execFileSync("git", ["config", "--global", "--get", k], { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+};
+const removeAll = async () => {
+  await request("PUT", "/api/me/git/signing", { key: null });
+  await request("DELETE", "/api/me/git/ssh-key");
+};
+
+before(async () => {
+  fs.mkdirSync(KEYS);
+  app = http.createServer(createApp());
+  await new Promise((r) => app.listen(0, "127.0.0.1", r));
+  base = `http://127.0.0.1:${app.address().port}`;
+});
+after(async () => {
+  await new Promise((r) => app.close(r));
+  fs.rmSync(ROOT, { recursive: true, force: true });
+});
+
+describe("POST /api/me/git/ssh-key/import", () => {
+  it("reads an OpenSSH ed25519 key into the public half ssh-keygen prints", async () => {
+    const k = keygen("ed", ["-t", "ed25519"]);
+    const r = await request("POST", "/api/me/git/ssh-key/import", { privateKey: k.text });
+    assert.equal(r.status, 201);
+    assert.equal(pubOf(r.body.imported.publicKey), k.pub);
+    assert.equal(r.body.imported.name, "signing");
+    assert.equal(r.body.imported.id, "id_ed25519_signing");
+    // Nothing private in the answer, and the file is the owner's alone.
+    assert.ok(!JSON.stringify(r.body).includes("PRIVATE KEY"));
+    const file = path.join(ROOT, ".claude", "agenthub-ssh", "id_ed25519_signing");
+    assert.equal(fs.statSync(file).mode & 0o777, 0o600);
+    // What was written is a key ssh-keygen itself reads back.
+    assert.equal(
+      pubOf(execFileSync("ssh-keygen", ["-y", "-f", file], { encoding: "utf8" }).trim()),
+      k.pub
+    );
+    await removeAll();
+  });
+
+  it("reads OpenSSH RSA and PEM (PKCS#8) RSA keys", async () => {
+    const k = keygen("rsa", ["-t", "rsa", "-b", "2048"]);
+    const a = await request("POST", "/api/me/git/ssh-key/import", { privateKey: k.text });
+    assert.equal(a.status, 201);
+    assert.equal(a.body.imported.id, "id_rsa_signing");
+    assert.equal(pubOf(a.body.imported.publicKey), k.pub);
+    const pem = crypto
+      .generateKeyPairSync("rsa", { modulusLength: 2048 })
+      .privateKey.export({ type: "pkcs8", format: "pem" });
+    const b = await request("POST", "/api/me/git/ssh-key/import", {
+      privateKey: pem,
+      name: "work",
+    });
+    assert.equal(b.status, 201);
+    assert.equal(b.body.imported.id, "id_rsa_work");
+    await removeAll();
+  });
+
+  it("refuses a passphrase key, a public key, an ecdsa key and the same key twice", async () => {
+    const enc = keygen("enc", ["-t", "ed25519"], "secret-pass");
+    const r1 = await request("POST", "/api/me/git/ssh-key/import", { privateKey: enc.text });
+    assert.equal(r1.status, 400);
+    assert.equal(r1.body.error.code, "EKEYPASSPHRASE");
+    const r2 = await request("POST", "/api/me/git/ssh-key/import", { privateKey: enc.pub });
+    assert.equal(r2.body.error.code, "EBADKEY");
+    assert.match(r2.body.error.message, /PUBLIC key/);
+    const ec = keygen("ec", ["-t", "ecdsa"]);
+    const r3 = await request("POST", "/api/me/git/ssh-key/import", { privateKey: ec.text });
+    assert.equal(r3.body.error.code, "EBADKEYTYPE");
+    const k = keygen("twice", ["-t", "ed25519"]);
+    assert.equal(
+      (await request("POST", "/api/me/git/ssh-key/import", { privateKey: k.text })).status,
+      201
+    );
+    const again = await request("POST", "/api/me/git/ssh-key/import", { privateKey: k.text });
+    assert.equal(again.status, 409);
+    assert.equal(again.body.error.code, "EEXISTS");
+    // A mangled paste never reaches the disk.
+    const lines = k.text.split("\n");
+    const i = 3; // inside the private section
+    lines[i] = lines[i].slice(0, 20) + (lines[i][20] === "Q" ? "R" : "Q") + lines[i].slice(21);
+    const bad = await request("POST", "/api/me/git/ssh-key/import", {
+      privateKey: lines.join("\n"),
+    });
+    assert.equal(bad.status, 400);
+    await removeAll();
+  });
+});
+
+describe("PUT /api/me/git/signing", () => {
+  it("signs a real commit with the imported key in one step", async () => {
+    const k = keygen("sign", ["-t", "ed25519"]);
+    const r = await request("POST", "/api/me/git/ssh-key/import", {
+      privateKey: k.text,
+      sign: true,
+    });
+    assert.equal(r.status, 201);
+    assert.equal(r.body.signError, null);
+    assert.deepEqual(r.body.signing, { state: "on", key: "id_ed25519_signing", path: null });
+    assert.equal(gitGet("gpg.format"), "ssh");
+    assert.equal(gitGet("commit.gpgsign"), "true");
+    // The PRIVATE file: ssh-keygen signs with it, no agent needed.
+    assert.match(gitGet("user.signingkey"), /agenthub-ssh\/id_ed25519_signing$/);
+
+    const repo = path.join(ROOT, "repo");
+    execFileSync("git", ["init", "-q", repo]);
+    const env = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "me@x" };
+    Object.assign(env, { GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "me@x" });
+    execFileSync("git", ["-C", repo, "commit", "-q", "--allow-empty", "-m", "signed"], { env });
+    const allowed = path.join(ROOT, "allowed");
+    fs.writeFileSync(allowed, `me@x ${k.pub}\n`);
+    const status = execFileSync(
+      "git",
+      ["-C", repo, "-c", `gpg.ssh.allowedSignersFile=${allowed}`, "log", "-1", "--format=%G?"],
+      { encoding: "utf8" }
+    ).trim();
+    assert.equal(status, "G");
+
+    // Deleting the signing key stops signing, so commits keep working.
+    await request("DELETE", "/api/me/git/ssh-key?id=id_ed25519_signing");
+    assert.equal(gitGet("user.signingkey"), "");
+    assert.equal(gitGet("commit.gpgsign"), "");
+    await removeAll();
+  });
+
+  it("keeps a signing key the user set themselves unless told to replace it", async () => {
+    execFileSync("git", ["config", "--global", "user.signingkey", "~/.ssh/id_ed25519"]);
+    const k = keygen("mine", ["-t", "ed25519"]);
+    const r = await request("POST", "/api/me/git/ssh-key/import", {
+      privateKey: k.text,
+      sign: true,
+    });
+    // The key is saved; only the switch was refused, and said so.
+    assert.equal(r.status, 201);
+    assert.equal(r.body.signError.code, "EFOREIGNSIGN");
+    assert.deepEqual(r.body.signing, { state: "foreign", key: null, path: "~/.ssh/id_ed25519" });
+    const off = await request("PUT", "/api/me/git/signing", { key: null });
+    assert.equal(off.status, 200);
+    assert.equal(gitGet("user.signingkey"), "~/.ssh/id_ed25519");
+    const on = await request("PUT", "/api/me/git/signing", {
+      key: r.body.imported.id,
+      replace: true,
+    });
+    assert.equal(on.status, 200);
+    assert.equal(on.body.signing.state, "on");
+    const stop = await request("PUT", "/api/me/git/signing", { key: null });
+    assert.equal(stop.body.signing.state, "off");
+    assert.equal(gitGet("gpg.format"), "");
+    const none = await request("PUT", "/api/me/git/signing", { key: "id_ed25519_nope" });
+    assert.equal(none.body.error.code, "ENOKEY");
+    await removeAll();
+  });
+});
+
+describe("PUT /api/me/git/signing/lane", () => {
+  const env = {
+    ...process.env,
+    GIT_AUTHOR_NAME: "t",
+    GIT_AUTHOR_EMAIL: "me@x",
+    GIT_COMMITTER_NAME: "t",
+    GIT_COMMITTER_EMAIL: "me@x",
+  };
+  const commit = (dir, msg) =>
+    execFileSync("git", ["-C", dir, "commit", "-q", "--allow-empty", "-m", msg], { env });
+  /** `G` signed and verified, `N` not signed. */
+  const sig = (dir, allowed) =>
+    execFileSync(
+      "git",
+      ["-C", dir, "-c", `gpg.ssh.allowedSignersFile=${allowed}`, "log", "-1", "--format=%G?"],
+      { encoding: "utf8" }
+    ).trim();
+  const lane = async (dir) => {
+    const r = await request("POST", "/api/lanes/ensure", { cwd: dir, exact: true });
+    return r.body.lane.id;
+  };
+
+  it("signs one workspace and its sessions' worktrees, never another repo", async () => {
+    const A = path.join(ROOT, "ws-a");
+    const B = path.join(ROOT, "ws-b");
+    const plain = path.join(ROOT, "ws-plain");
+    for (const d of [A, B]) {
+      execFileSync("git", ["init", "-q", d]);
+      commit(d, "first");
+    }
+    fs.mkdirSync(plain);
+    const [a, b, p] = [await lane(A), await lane(B), await lane(plain)];
+    // A user's own include stays whatever we do.
+    execFileSync("git", ["config", "--global", "includeIf.gitdir:/elsewhere/.path", "/mine"]);
+    const k = keygen("lane", ["-t", "ed25519"]);
+    const imp = await request("POST", "/api/me/git/ssh-key/import", {
+      privateKey: k.text,
+      name: "lane",
+    });
+    const key = imp.body.imported.id;
+    const allowed = path.join(ROOT, "allowed-lane");
+    fs.writeFileSync(allowed, `me@x ${k.pub}\n`);
+
+    const on = await request("PUT", "/api/me/git/signing/lane", { laneId: a, key });
+    assert.equal(on.status, 200);
+    assert.deepEqual(on.body.laneSigning, [{ laneId: a, key }]);
+    // Nothing account-wide: the global settings stay unset.
+    assert.equal(on.body.signing.state, "off");
+    assert.equal(gitGet("commit.gpgsign"), "");
+    commit(A, "in a");
+    commit(B, "in b");
+    assert.equal(sig(A, allowed), "G");
+    assert.equal(sig(B, allowed), "N");
+    // A session's worktree of A is signed; any other worktree of A is not.
+    const wt = path.join(A, ".claude", "worktrees", `ah-${a}-x1`);
+    const other = path.join(ROOT, "other-wt");
+    execFileSync("git", ["-C", A, "worktree", "add", "-q", "-b", "s1", wt]);
+    execFileSync("git", ["-C", A, "worktree", "add", "-q", "-b", "s2", other]);
+    commit(wt, "in session worktree");
+    commit(other, "in other worktree");
+    assert.equal(sig(wt, allowed), "G");
+    assert.equal(sig(other, allowed), "N");
+    // Nothing was written into the repository itself.
+    assert.doesNotMatch(fs.readFileSync(path.join(A, ".git", "config"), "utf8"), /gpgsign/);
+
+    // Not a repo: refused; an unknown workspace: 404.
+    const notRepo = await request("PUT", "/api/me/git/signing/lane", { laneId: p, key });
+    assert.equal(notRepo.status, 409);
+    assert.equal(notRepo.body.error.code, "ENOREPO");
+    const gone = await request("PUT", "/api/me/git/signing/lane", { laneId: 9999, key });
+    assert.equal(gone.status, 404);
+
+    // Off: unsigned again, our file gone, the user's include kept.
+    const off = await request("PUT", "/api/me/git/signing/lane", { laneId: a, key: null });
+    assert.deepEqual(off.body.laneSigning, []);
+    commit(A, "after off");
+    assert.equal(sig(A, allowed), "N");
+    assert.equal(gitGet("includeIf.gitdir:/elsewhere/.path"), "/mine");
+
+    // A workspace removed from the dashboard while it signed can still be turned off.
+    await request("PUT", "/api/me/git/signing/lane", { laneId: b, key });
+    await request("POST", `/api/lanes/${b}/remove`, {});
+    const orphan = await request("GET", "/api/me/git");
+    assert.deepEqual(orphan.body.laneSigning, [{ laneId: b, key }]);
+    const stopGone = await request("PUT", "/api/me/git/signing/lane", { laneId: b, key: null });
+    assert.equal(stopGone.status, 200);
+    assert.deepEqual(stopGone.body.laneSigning, []);
+    const b2 = await lane(B);
+
+    // Deleting the key stops every workspace that signs with it.
+    await request("PUT", "/api/me/git/signing/lane", { laneId: a, key });
+    await request("PUT", "/api/me/git/signing/lane", { laneId: b2, key });
+    const del = await request("DELETE", `/api/me/git/ssh-key?id=${key}`);
+    assert.equal(del.status, 200);
+    assert.deepEqual(del.body.laneSigning, []);
+    commit(A, "after the key went");
+    assert.equal(sig(A, allowed), "N");
+    assert.equal(gitGet("includeIf.gitdir:/elsewhere/.path"), "/mine");
+    assert.deepEqual(
+      fs
+        .readdirSync(path.join(ROOT, ".claude", "agenthub-signing"))
+        .filter((n) => n.endsWith(".gitconfig")),
+      []
+    );
+    execFileSync("git", ["config", "--global", "--unset-all", "includeIf.gitdir:/elsewhere/.path"]);
+    await removeAll();
+  });
+
+  it("takes out a signing setup the user made themselves, keeping their key file", async () => {
+    const mine = path.join(ROOT, "my-own-key");
+    fs.writeFileSync(mine, "not ours");
+    execFileSync("git", ["config", "--global", "user.signingkey", mine]);
+    execFileSync("git", ["config", "--global", "commit.gpgsign", "true"]);
+    const kept = await request("PUT", "/api/me/git/signing", { key: null });
+    assert.equal(kept.body.signing.state, "foreign");
+    const r = await request("PUT", "/api/me/git/signing", { key: null, clearForeign: true });
+    assert.equal(r.status, 200);
+    assert.equal(r.body.signing.state, "off");
+    assert.equal(gitGet("user.signingkey"), "");
+    assert.equal(gitGet("commit.gpgsign"), "");
+    assert.equal(fs.readFileSync(mine, "utf8"), "not ours");
+  });
+});

server/__tests__/home-files.test.js

@@ -6,6 +6,7 @@
  * fine, delete/restore work with no workspace, a copy goes home ↔ workspace
  * under each side's own rule — and in server mode a developer never reaches
  * another user's home while an admin gets it read-only — except its Trash,
+ * and a resumable upload in parts lands in the home under the same rule,
  * which the admin lists, restores from and purges as the member's own.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
@@ -166,6 +167,38 @@ describe("File Explorer on the home", () => {
     assert.ok(!fs.existsSync(path.join(WS, "id_ed25519")));
   });
 
+  it("resumes an upload into the home in parts, under the home rule", async () => {
+    const raw = (method, p, body) =>
+      fetch(`${base}${p}`, {
+        method,
+        headers: { "Content-Type": "application/octet-stream" },
+        body,
+      }).then(async (r) => ({ status: r.status, body: await r.json() }));
+    const id = "home-resume-00000001";
+    const data = Buffer.from("home bytes");
+    assert.equal(
+      (
+        await raw(
+          "POST",
+          `${H}/upload-part?upload=${id}&offset=0&total=${data.length}`,
+          data.subarray(0, 4)
+        )
+      ).body.received,
+      4
+    );
+    assert.equal((await request("GET", `${H}/upload-part?upload=${id}`)).body.received, 4);
+    await raw(
+      "POST",
+      `${H}/upload-part?upload=${id}&offset=4&total=${data.length}`,
+      data.subarray(4)
+    );
+    // The home rule still holds for the staged bytes: no top-level dot entry.
+    assert.equal((await raw("POST", `${H}/upload?path=.ssh/x&staged=${id}`)).status, 403);
+    const ok = await raw("POST", `${H}/upload?path=docs/up.txt&staged=${id}`);
+    assert.equal(ok.status, 201);
+    assert.equal(fs.readFileSync(path.join(HOME, "docs/up.txt"), "utf8"), "home bytes");
+  });
+
   it("refuses an unknown home", async () => {
     assert.equal((await request("GET", "/api/homes/someone/fs/list")).status, 404);
   });
@@ -256,13 +289,10 @@ describe("an admin manages a member's Trash", () => {
 
     // …and every user's in one list, each item tagged with its home and owner.
     const all = (await call("GET", "/api/homes/trash", dan)).body;
-    assert.deepEqual(
-      all.items.map((i) => [i.name, i.home, i.owner]).sort(),
-      [
-        ["junk", "cara", "cara"],
-        ["old", "cara", "cara"],
-      ]
-    );
+    assert.deepEqual(all.items.map((i) => [i.name, i.home, i.owner]).sort(), [
+      ["junk", "cara", "cara"],
+      ["old", "cara", "cara"],
+    ]);
     // A developer's merged view is only their own.
     assert.deepEqual(
       (await call("GET", "/api/homes/trash", cara)).body.items.map((i) => i.home),

server/__tests__/lane-sources.test.js

@@ -208,6 +208,9 @@ describe("lane-sources instructions and launch", () => {
     // Claude Code hides its task tools from newer models without this, and the
     // chat Progress panel is drawn from those calls.
     assert.ok(newSession.includes("CLAUDE_CODE_ENABLE_TODO_TOOLS=1"));
+    // One wheel notch reaches claude as one report; it scrolls this many lines.
+    if (!process.env.CLAUDE_CODE_SCROLL_SPEED)
+      assert.ok(newSession.includes("CLAUDE_CODE_SCROLL_SPEED=5"));
     assert.deepEqual(fs.readdirSync(dir), ["CLAUDE.md"]);
     const text = fs.readFileSync(path.join(dir, "CLAUDE.md"), "utf8");
     assert.match(text, /^- always answer in Vietnamese/);

server/__tests__/me-avatar.test.js

@@ -4,8 +4,9 @@
  * server/lib/avatars.js): an account sets, reads and removes its own picture;
  * only PNG/JPEG/GIF/WebP by magic bytes (an SVG is refused), at most 1 MB,
  * served with `nosniff` and a `sandbox` CSP; `avatarAt` reaches `/api/auth/me`;
- * another account never sees it through `/api/me`; staff read it at
- * `/api/users/:id/avatar` (a developer is refused) and a workspace carries
+ * another account never sees it through `/api/me`; every account reads it at
+ * `/api/users/:id/avatar` (a developer too — only the picture, the rest of
+ * `/users` stays staff-only) and a workspace carries
  * `owner_avatar_at` for the sidebar's owner groups. A picture from a link
  * (`POST /api/me/avatar/url`, server/lib/avatar-url.js) is stored, never
  * downloaded, and the avatar routes redirect to it; https only, never a
@@ -196,7 +197,7 @@ it("a picture from a link: https only, never a private or local address", async
   }
 });
 
-it("staff read another account's avatar; workspaces carry owner_avatar_at", async () => {
+it("every account reads another's avatar; workspaces carry owner_avatar_at", async () => {
   const ava = await login("ava", "ava-pass-1");
   const ann = await login("ann", "ann-pass-1");
   const bob = await login("bob", "bob-pass-1");
@@ -210,8 +211,12 @@ it("staff read another account's avatar; workspaces carry owner_avatar_at", asyn
   assert.deepEqual(Buffer.from(await got.arrayBuffer()), PNG);
   assert.equal(
     (await fetch(`${BASE}/api/users/${id}/avatar`, { headers: { cookie: bob } })).status,
-    403
+    200
   );
+  // Only the picture: the rest of /users stays staff-only for a developer.
+  for (const path of [`/api/users/${id}`, `/api/users/${id}/details`, "/api/users"]) {
+    assert.equal((await fetch(BASE + path, { headers: { cookie: bob } })).status, 403, path);
+  }
   const lanes = (await (await fetch(BASE + "/api/lanes", { headers: { cookie: ann } })).json())
     .lanes;
   assert.ok(lanes.find((l) => l.cwd === "/w/ava").owner_avatar_at);

server/__tests__/member-guard.test.js

@@ -0,0 +1,160 @@
+/**
+ * @file Tests for the S3 members' synchronous hook (scripts/member-guard.js)
+ * and the AI-session counter it shares with spawnRun (server/lib/ai-procs.js):
+ * which Bash commands count as a test run or a container command, and which
+ * processes count as one top-level AI session, read from a fake /proc.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const { isHeavy, guardTool } = require("../../scripts/member-guard.js");
+const procs = require("../lib/ai-procs.js");
+
+describe("member-guard: a test run or a container command", () => {
+  const heavy = [
+    "npx vitest run",
+    "vitest",
+    "npm test",
+    "npm t",
+    "npm run test:unit",
+    "pnpm test",
+    "yarn test --watch=false",
+    "bun test",
+    "cd client && NODE_ENV=test npx vitest related src/a.ts --run",
+    "timeout 300 npx jest",
+    "./vendor/bin/phpunit --filter Foo",
+    "php artisan test",
+    "vendor/bin/pest",
+    "python -m pytest -q",
+    "pytest tests/",
+    "go test ./...",
+    "cargo test",
+    "docker compose up -d",
+    "docker-compose up",
+    "podman run alpine",
+    "node_modules/.bin/playwright test",
+    'bash -c "npm run e2e"',
+    "make test",
+    "npm run build && npm test 2>&1 | tail -20",
+  ];
+  const fine = [
+    "npm run build",
+    "npm install -D vitest",
+    "git commit -m 'add vitest tests'",
+    "rg -n docker src/",
+    "cat tests/a.test.js",
+    "ls node_modules/.bin/vitest",
+    "echo run npm test later",
+    "npx tsc -b",
+    "npm run lint",
+    "php artisan migrate:status",
+    "go build ./...",
+    "git log --grep test",
+    "composer install",
+  ];
+  for (const c of heavy) it(`refuses: ${c}`, () => assert.equal(isHeavy(c), true));
+  for (const c of fine) it(`allows: ${c}`, () => assert.equal(isHeavy(c), false));
+
+  it("answers Claude Code with a PreToolUse deny and its reason, and nothing for the rest", () => {
+    const out = [];
+    const write = process.stdout.write;
+    process.stdout.write = (s) => out.push(String(s));
+    try {
+      guardTool({ tool_name: "Bash", tool_input: { command: "npm test" } });
+      guardTool({ tool_name: "Bash", tool_input: { command: "npm run build" } });
+      guardTool({ tool_name: "Read", tool_input: { file_path: "/x" } });
+    } finally {
+      process.stdout.write = write;
+    }
+    assert.equal(out.length, 1);
+    const o = JSON.parse(out[0]).hookSpecificOutput;
+    assert.equal(o.hookEventName, "PreToolUse");
+    assert.equal(o.permissionDecision, "deny");
+    assert.match(o.permissionDecisionReason, /own machine/);
+  });
+
+  it("lets everything through once an admin allows tests", () => {
+    const out = [];
+    const write = process.stdout.write;
+    process.stdout.write = (s) => out.push(String(s));
+    try {
+      guardTool({ tool_name: "Bash", tool_input: { command: "npx vitest run" } }, true);
+    } finally {
+      process.stdout.write = write;
+    }
+    assert.equal(out.length, 0);
+  });
+});
+
+/** A fake /proc: one dir per pid with stat, cmdline; owner is this process (uid). */
+function fakeProc(list) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "ah-proc-"));
+  for (const p of list) {
+    const d = path.join(root, String(p.pid));
+    fs.mkdirSync(d);
+    // pid (comm) state ppid ... field 22 = starttime (index 19 after the ')')
+    const fields = ["S", String(p.ppid), ...Array(17).fill("0"), String(p.start)];
+    fs.writeFileSync(path.join(d, "stat"), `${p.pid} (x y) ${fields.join(" ")}`);
+    fs.writeFileSync(path.join(d, "cmdline"), p.argv.join("\0") + "\0");
+  }
+  return root;
+}
+
+describe("member-policy: the admin's switch, read by the guard", () => {
+  it("blocks tests without a file, and writes a world-readable one", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ah-app-"));
+    const prev = process.env.AGENTHUB_APP_ROOT;
+    process.env.AGENTHUB_APP_ROOT = dir;
+    try {
+      const policy = require("../lib/member-policy.js");
+      assert.equal(policy.read().allowTests, false);
+      fs.writeFileSync(path.join(dir, policy.FILE), "not json");
+      assert.equal(policy.read().allowTests, false);
+      assert.equal(policy.setAllowTests(true).allowTests, true);
+      const f = path.join(dir, policy.FILE);
+      assert.equal(fs.statSync(f).mode & 0o777, 0o644);
+      assert.equal(policy.read(f).allowTests, true);
+      assert.equal(policy.setAllowTests(false).allowTests, false);
+    } finally {
+      if (prev === undefined) delete process.env.AGENTHUB_APP_ROOT;
+      else process.env.AGENTHUB_APP_ROOT = prev;
+    }
+  });
+});
+
+describe("ai-procs: a member's top-level AI sessions", () => {
+  const uid = process.getuid();
+  const root = fakeProc([
+    { pid: 10, ppid: 1, start: 1, argv: ["tmux"] },
+    { pid: 11, ppid: 10, start: 5, argv: ["/opt/agenthub/tools/bin/claude", "--resume", "x"] },
+    { pid: 12, ppid: 11, start: 6, argv: ["/bin/bash", "-c", "claude -p hi"] },
+    { pid: 13, ppid: 12, start: 7, argv: ["claude", "-p", "hi"] }, // nested: not counted
+    { pid: 20, ppid: 10, start: 3, argv: ["bash"] }, // a Terminal tab
+    { pid: 21, ppid: 20, start: 4, argv: ["node", "/x/@openai/codex/bin/codex.js"] },
+    { pid: 22, ppid: 21, start: 4, argv: ["/x/codex", "--yolo"] }, // Codex's native child
+    { pid: 30, ppid: 10, start: 9, argv: ["omp", "auth-gateway", "serve"] }, // a server
+    { pid: 31, ppid: 10, start: 8, argv: ["vitest"] },
+  ]);
+
+  it("counts each session once, oldest first, and no tool server", () => {
+    assert.deepEqual(
+      procs.sessionsOf(uid, root).map((s) => s.pid),
+      [21, 11]
+    );
+  });
+  it("finds the session a hook process runs under", () => {
+    assert.equal(procs.sessionOf(13, root), 11);
+    assert.equal(procs.sessionOf(31, root), null);
+  });
+  it("reads the limit from server.conf, 4 without it, 0 = off", () => {
+    const conf = path.join(root, "server.conf");
+    assert.equal(procs.sessionLimit(conf), 4);
+    fs.writeFileSync(conf, "HOST_USER=x\nMAX_AI_SESSIONS=0\n");
+    assert.equal(procs.sessionLimit(conf), 0);
+  });
+});

server/__tests__/server-s3-lanes.test.js

@@ -192,3 +192,31 @@ describe("a member's new project folder", () => {
     assert.equal(fs.existsSync(path.join(TMP, "host-new")), false);
   });
 });
+
+describe("the pet chat's workspace for a member", () => {
+  it("is <their folder>/sagi, made as them — never the host's home (EFOLDER)", async () => {
+    const { fakeSudo } = require("./fixtures/fake-sudo");
+    const sudo = fakeSudo();
+    runAs.__setExecImpl(sudo.exec);
+    const login = await fetch(`${BASE}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ username: "mia", password: "member-pass-1" }),
+    });
+    const cm = login.headers.get("set-cookie").split(";")[0];
+    const ensure = () =>
+      fetch(`${BASE}/api/lanes/ensure`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", cookie: cm },
+        body: JSON.stringify({ title: "Sagi" }),
+      }).then(async (r) => ({ status: r.status, body: await r.json() }));
+    const first = await ensure();
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    const want = fs.realpathSync(path.join(USERS, "mia", "sagi"));
+    assert.equal(first.body.lane.cwd, want);
+    const mk = sudo.calls.find((c) => c.includes("/opt/agenthub/libexec/write-as"));
+    assert.ok(mk && mk.includes("ah-mia") && mk.includes("mkdir"));
+    const again = await ensure();
+    assert.equal(again.body.lane.id, first.body.lane.id, "the same workspace next time");
+  });
+});

server/__tests__/turn-end-without-stop.test.js

@@ -0,0 +1,106 @@
+/**
+ * @file Regression test: a turn the transcript says has ended lands the main
+ * agent in Waiting even when Claude Code never sends the Stop hook (it skips
+ * it in some turns — only the prompt-suggestion helper's SubagentStop
+ * arrives). Before, the agent stayed `working` until the idle Notification a
+ * minute later and the chat showed Stop on a finished answer. A turn end OLDER
+ * than the last prompt, or one read on new work (UserPromptSubmit), must not.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const fs = require("fs");
+const os = require("os");
+const http = require("http");
+
+const STAMP = `turn-end-${Date.now()}-${process.pid}`;
+const TMP = path.join(os.tmpdir(), STAMP);
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.CLAUDE_HOME = path.join(TMP, "home");
+process.env.DASHBOARD_DATA_DIR = path.join(TMP, "data");
+
+const { createApp, startServer } = require("../index");
+const { stmts } = require("../db");
+
+let server;
+let BASE;
+
+function post(body) {
+  return new Promise((resolve, reject) => {
+    const url = new URL("/api/hooks/event", BASE);
+    const payload = JSON.stringify(body);
+    const r = http.request(
+      {
+        hostname: url.hostname,
+        port: url.port,
+        path: url.pathname,
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) },
+      },
+      (res) => {
+        res.resume();
+        res.on("end", () => resolve(res.statusCode));
+      }
+    );
+    r.on("error", reject);
+    r.write(payload);
+    r.end();
+  });
+}
+
+const line = (o) => JSON.stringify(o) + "\n";
+const user = (text) => ({ type: "user", message: { role: "user", content: text } });
+const reply = (id) => ({
+  type: "assistant",
+  message: { id, model: "claude-sonnet-5", content: [{ type: "text", text: "ok" }], usage: { input_tokens: 1, output_tokens: 1 } },
+});
+const turnEnd = (ts) => ({ type: "system", subtype: "turn_duration", durationMs: 900, timestamp: ts });
+
+before(async () => {
+  fs.mkdirSync(TMP, { recursive: true });
+  server = await startServer(createApp(), 0);
+  BASE = `http://127.0.0.1:${server.address().port}`;
+});
+
+after(() => {
+  server?.close();
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+describe("a finished turn without a Stop hook", () => {
+  it("lands in Waiting on the next hook that reads the turn's end", async () => {
+    const cwd = path.join(TMP, "work");
+    fs.mkdirSync(cwd, { recursive: true });
+    const sid = "12121212-3434-5656-7878-909090909090";
+    const tpath = path.join(TMP, `${sid}.jsonl`);
+    const event = (extra = {}) => ({ session_id: sid, cwd, transcript_path: tpath, ...extra });
+    const main = () => stmts.getAgent.get(`${sid}-main`);
+
+    fs.writeFileSync(tpath, line(user("hello")));
+    assert.equal(await post({ hook_type: "UserPromptSubmit", data: event({ prompt: "hello" }) }), 200);
+    assert.equal(main().status, "working");
+
+    // The turn ends; Claude Code writes turn_duration but sends no Stop —
+    // only a helper agent's SubagentStop arrives.
+    fs.appendFileSync(tpath, line(reply("m1")) + line(turnEnd(new Date().toISOString())));
+    assert.equal(
+      await post({ hook_type: "SubagentStop", data: event({ agent_id: "a1", agent_type: "" }) }),
+      200
+    );
+    assert.equal(main().status, "waiting");
+    assert.equal(stmts.getSession.get(sid).awaiting_reason, "stop");
+
+    // A new prompt: that turn's old end must not end the new one.
+    await new Promise((r) => setTimeout(r, 5));
+    fs.appendFileSync(tpath, line(user("again")));
+    assert.equal(await post({ hook_type: "UserPromptSubmit", data: event({ prompt: "again" }) }), 200);
+    assert.equal(main().status, "working");
+    assert.equal(
+      await post({ hook_type: "SubagentStop", data: event({ agent_id: "a2", agent_type: "" }) }),
+      200
+    );
+    assert.equal(main().status, "working", "no turn end newer than the prompt yet");
+  });
+});

server/__tests__/websocket-mine.test.js

@@ -0,0 +1,102 @@
+/**
+ * @file websocket-mine.test.js
+ * @description Server mode broadcasts (server/websocket.js `broadcast`): an
+ * admin/analyst's session, agent and event frames say whether the session is
+ * their OWN (`mine`), a developer's and local mode's never carry it, and
+ * `GET /api/sessions?mine=1` (server/routes/sessions.js) lists only the
+ * caller's own sessions whatever their role — the pet counts only those.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const fs = require("node:fs");
+const os = require("node:os");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "ws-mine-test-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+
+const { db } = require("../db");
+const ws = require("../websocket");
+
+const prevMode = process.env.AGENTHUB_MODE;
+before(() => {
+  const lane = db.prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES (?, 'claude', ?)");
+  lane.run("/w/boss", 99); // id 1, the admin's
+  lane.run("/w/dev", 2); // id 2, a developer's
+  const s = db.prepare(
+    "INSERT INTO sessions (id, name, status, cwd, lane_id) VALUES (?, ?, 'active', '/w', ?)"
+  );
+  s.run("s-boss", "boss", 1);
+  s.run("s-dev", "dev", 2);
+});
+
+after(() => {
+  ws._setClientsForTest(null);
+  if (prevMode === undefined) delete process.env.AGENTHUB_MODE;
+  else process.env.AGENTHUB_MODE = prevMode;
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+function client(user) {
+  const got = [];
+  return { readyState: 1, user, got, send: (m) => got.push(JSON.parse(m)) };
+}
+
+describe("broadcast `mine`", () => {
+  it("marks an admin's frames by whose session it is; a developer gets only theirs, unmarked", () => {
+    process.env.AGENTHUB_MODE = "server";
+    const boss = client({ id: 99, username: "boss", role: "admin" });
+    const dev = client({ id: 2, username: "dev", role: "developer" });
+    ws._setClientsForTest(new Set([boss, dev]));
+    ws.broadcast("session_updated", { id: "s-boss", status: "active" });
+    ws.broadcast("new_event", { session_id: "s-dev", event_type: "PostToolUse" });
+    ws.broadcast("lane_update", { lane: { id: 2 } });
+    assert.deepEqual(
+      boss.got.map((m) => [m.type, m.mine]),
+      [
+        ["session_updated", true],
+        ["new_event", false],
+        ["lane_update", undefined],
+      ]
+    );
+    assert.deepEqual(
+      dev.got.map((m) => [m.type, m.mine]),
+      [
+        ["new_event", undefined],
+        ["lane_update", undefined],
+      ]
+    );
+  });
+
+  it("adds nothing in local mode", () => {
+    delete process.env.AGENTHUB_MODE;
+    const me = client(null);
+    ws._setClientsForTest(new Set([me]));
+    ws.broadcast("session_updated", { id: "s-dev" });
+    assert.equal(me.got[0].mine, undefined);
+  });
+});
+
+describe("GET /api/sessions?mine=1", () => {
+  it("lists only the caller's own sessions, an admin's too", async () => {
+    const express = require("express");
+    const app = express();
+    app.use((req, _res, next) => {
+      req.user = { id: 99, username: "boss", role: "admin" };
+      next();
+    });
+    app.use("/api/sessions", require("../routes/sessions"));
+    const srv = app.listen(0);
+    try {
+      const base = `http://127.0.0.1:${srv.address().port}/api/sessions`;
+      const ids = async (qs) =>
+        (await (await fetch(base + qs)).json()).sessions.map((s) => s.id).sort();
+      assert.deepEqual(await ids("?mine=1"), ["s-boss"]);
+      assert.deepEqual(await ids(""), ["s-boss", "s-dev"]);
+    } finally {
+      srv.close();
+    }
+  });
+});

server/db.js

@@ -1854,6 +1854,22 @@ try {
   db.prepare("ALTER TABLE dashboard_runs ADD COLUMN chat_token_hash TEXT").run();
 }
 
+// v2.8.65–2.8.66 shipped a chat between users (chat_* tables, uploads under
+// <data dir>/chat/); it was removed in v2.8.67, and its data goes with it.
+try {
+  db.exec(`
+    DROP TABLE IF EXISTS chat_files;
+    DROP TABLE IF EXISTS chat_messages;
+    DROP TABLE IF EXISTS chat_members;
+    DROP TABLE IF EXISTS chat_rooms;
+  `);
+  if (!process.env.DASHBOARD_DB_PATH) {
+    fs.rmSync(path.join(getDataDir(), "chat"), { recursive: true, force: true });
+  }
+} catch {
+  /* best effort: a leftover is unused */
+}
+
 // Server mode: whose browser a push subscription is (`users.id`); NULL in
 // local mode. A user's notifications go only to their own subscriptions.
 try {

server/lib/ai-procs.js

@@ -0,0 +1,116 @@
+/**
+ * @file ai-procs.js
+ * @description Server mode, one Linux user per account (S3): counts the AI
+ * Tools sessions a Linux account is running RIGHT NOW, from /proc — whoever
+ * started them (a dashboard pane, or `claude` typed into a terminal tab).
+ * A session is a process whose program is one of the catalog tools' binaries
+ * (`claude`, `codex`, `agy`, `cursor-agent`, `omp`) with no such process
+ * among its ancestors, so a nested `claude -p`, Codex's native child behind
+ * its npm launcher, or a subagent never counts twice. Used by `spawnRun`
+ * (ESESSIONLIMIT before a pane starts) and by `scripts/member-guard.js`
+ * (refuses the prompt of a session over the limit started by hand), which
+ * runs AS the member and sees only that member's processes (hidepid) — that
+ * is all it needs. Pure Node built-ins: the guard runs from /opt/agenthub/app.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+/** The catalog tools' binary names (server/data/ai-tools/*.json `binary`). */
+const AI_BINS = new Set(["claude", "codex", "agy", "cursor-agent", "omp"]);
+/** Interpreters whose first argument names the tool (an npm launcher). */
+const INTERPRETERS = new Set(["node", "nodejs", "bun", "deno"]);
+/** A tool's server, not a session (the host's omp share). */
+const NOT_A_SESSION = new Set(["auth-gateway", "auth-broker", "mcp", "daemon"]);
+
+const DEFAULT_LIMIT = 4;
+const CONF = "/etc/agenthub/server.conf";
+
+const base = (p) => path.basename(String(p || "")).replace(/\.(c|m)?js$/, "");
+
+/** `{pid, ppid, uid, start, ai}` for one /proc entry, or null once it is gone. */
+function readProc(pid, procRoot = "/proc") {
+  try {
+    const dir = path.join(procRoot, String(pid));
+    const stat = fs.readFileSync(path.join(dir, "stat"), "utf8");
+    // comm may hold spaces and parentheses: the fields start after the LAST ')'.
+    const f = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const argv = fs.readFileSync(path.join(dir, "cmdline"), "utf8").split("\0").filter(Boolean);
+    const uid = fs.statSync(dir).uid;
+    let name = base(argv[0]);
+    let rest = argv.slice(1);
+    if (INTERPRETERS.has(name)) {
+      const i = rest.findIndex((a) => !a.startsWith("-"));
+      name = i === -1 ? "" : base(rest[i]);
+      rest = i === -1 ? [] : rest.slice(i + 1);
+    }
+    const ai = AI_BINS.has(name) && !rest.some((a) => NOT_A_SESSION.has(a));
+    return { pid: Number(pid), ppid: Number(f[1]), start: Number(f[19]), uid, ai };
+  } catch {
+    return null; // exited while we looked, or not ours to read
+  }
+}
+
+/**
+ * The account's top-level AI sessions, oldest first.
+ * @param {number} uid
+ * @returns {{pid:number, start:number}[]}
+ */
+function sessionsOf(uid, procRoot = "/proc") {
+  const procs = new Map();
+  let names = [];
+  try {
+    names = fs.readdirSync(procRoot);
+  } catch {
+    return [];
+  }
+  for (const n of names) {
+    if (!/^\d+$/.test(n)) continue;
+    const p = readProc(n, procRoot);
+    if (p) procs.set(p.pid, p);
+  }
+  const out = [];
+  for (const p of procs.values()) {
+    if (!p.ai || p.uid !== uid) continue;
+    let nested = false;
+    const seen = new Set();
+    for (let a = procs.get(p.ppid); a && !seen.has(a.pid); a = procs.get(a.ppid)) {
+      seen.add(a.pid);
+      if (a.ai) {
+        nested = true;
+        break;
+      }
+    }
+    if (!nested) out.push({ pid: p.pid, start: p.start });
+  }
+  return out.sort((a, b) => a.start - b.start || a.pid - b.pid);
+}
+
+/** The pid of the top-level AI session `pid` runs under (itself included), or null. */
+function sessionOf(pid, procRoot = "/proc") {
+  let top = null;
+  const seen = new Set();
+  for (let p = readProc(pid, procRoot); p && !seen.has(p.pid); p = readProc(p.ppid, procRoot)) {
+    seen.add(p.pid);
+    if (p.ai) top = p.pid;
+    if (p.ppid <= 1) break;
+  }
+  return top;
+}
+
+/**
+ * The most AI sessions one member may run at once: `MAX_AI_SESSIONS` in
+ * server.conf (0 = no limit), else 4.
+ */
+function sessionLimit(confFile = CONF) {
+  try {
+    const m = fs.readFileSync(confFile, "utf8").match(/^MAX_AI_SESSIONS=(\d+)\s*$/m);
+    if (m) return Number(m[1]);
+  } catch {
+    /* no server.conf: the default */
+  }
+  return DEFAULT_LIMIT;
+}
+
+module.exports = { AI_BINS, DEFAULT_LIMIT, readProc, sessionsOf, sessionOf, sessionLimit };

server/lib/auth.js

@@ -128,6 +128,11 @@ const STAFF_ONLY_PREFIXES = [
 // Staff-only paths with an id in the middle, matched on `apiPath()`'s
 // lower-cased form: the host's own AI-tool config files (they may hold keys).
 const STAFF_ONLY_PATTERNS = [/^\/ai-tools\/[^/]+\/config(\/|$)/];
+// The one read under a staff-only prefix every signed-in user may make: an
+// account's PICTURE (`GET /users/:id/avatar` — the image or a redirect to its
+// link, nothing else of the account). System Health shows every user's name and
+// `avatarAt` to everyone, so a developer refused here saw only initials.
+const EVERYONE_READS = [/^\/users\/\d+\/avatar$/];
 
 const isServerMode = () => process.env.AGENTHUB_MODE === "server";
 
@@ -789,6 +794,7 @@ function authGuard(req, res, next) {
   const isRead = req.method === "GET" || req.method === "HEAD";
   if (
     user.role === "developer" &&
+    !(isRead && EVERYONE_READS.some((re) => re.test(lp))) &&
     (STAFF_ONLY_PREFIXES.some(under) || STAFF_ONLY_PATTERNS.some((re) => re.test(lp)))
   ) {
     return deny(res, 403, "EADMIN", "only an admin or analyst may open this");

server/lib/file-explorer.js

@@ -634,16 +634,26 @@ async function purgeTrash(dir, userKey, id) {
 
 // ── Upload ─────────────────────────────────────────────────────────────────
 
-/** A pass-through that fails once more than `max` bytes went by. */
+/** A pass-through that fails once more than `max` bytes went by (`seen()`: the count). */
 function capped(max) {
   let n = 0;
-  return new Transform({
+  const t = new Transform({
     transform(chunk, _enc, cb) {
       n += chunk.length;
       if (n > max) return cb(bad("ETOOBIG", `a file may be at most ${max / 1024 / 1024} MB`));
       cb(null, chunk);
     },
   });
+  t.seen = () => n;
+  return t;
+}
+
+/** A body that stopped short of its announced length (a dropped connection). */
+function shortBody(limit, length) {
+  if (length == null || length === "") return null;
+  const want = Number(length);
+  if (!Number.isSafeInteger(want) || limit.seen() === want) return null;
+  return bad("EBADBODY", `the upload ended early (${limit.seen()} of ${want} bytes)`);
 }
 
 /**
@@ -677,16 +687,41 @@ async function upload(dir, rel, stream, { conflict, length, trash } = {}) {
   }
   const acct = accountAt(loc.abs);
   const limit = capped(UPLOAD_MAX_BYTES);
-  if (acct) {
-    // write-as `replace`: a new file renamed over the name, as the member.
-    const done = runAs.writeAsAsync(acct, loc.abs, ["replace"], { input: limit });
-    await Promise.all([
+  const feed = (done) =>
+    Promise.all([
       pipeline(stream, limit).catch((e) => {
         limit.destroy(e);
         throw e;
       }),
       done,
     ]);
+  if (acct && runAs.writeAsCanMove()) {
+    // As the member: a hidden temp file, moved onto the name only once every
+    // byte arrived. write-as cannot tell a dropped connection (or a server
+    // that died mid-upload) from the end of the file — writing the name
+    // itself would leave a truncated file there under its real name.
+    const tmp = path.join(
+      loc.parent.abs,
+      `.${loc.name}.agenthub-upload-${crypto.randomBytes(4).toString("hex")}`
+    );
+    try {
+      await feed(runAs.writeAsAsync(acct, tmp, [], { input: limit }));
+      const short = shortBody(limit, length);
+      if (short) throw short;
+      // `move` never lands on an existing name: one taken meanwhile is refused.
+      await runAs.writeAsAsync(acct, tmp, ["move", loc.abs]).catch((e) => {
+        if (/exists/.test(e.message)) {
+          throw bad("EEXISTS", `${loc.rel} already exists`, { names: [loc.name] });
+        }
+        throw e;
+      });
+    } catch (e) {
+      await runAs.writeAsAsync(acct, tmp, ["remove"]).catch(() => {});
+      throw e;
+    }
+  } else if (acct) {
+    // An older write-as without `move`: `replace` (a new file renamed over the name).
+    await feed(runAs.writeAsAsync(acct, loc.abs, ["replace"], { input: limit }));
   } else {
     const tmp = path.join(
       loc.parent.abs,
@@ -694,6 +729,8 @@ async function upload(dir, rel, stream, { conflict, length, trash } = {}) {
     );
     try {
       await pipeline(stream, limit, fs.createWriteStream(tmp, { flags: "wx" }));
+      const short = shortBody(limit, length);
+      if (short) throw short;
       // Linked, not renamed: a name taken meanwhile is refused, never replaced.
       await fs.promises.link(tmp, loc.abs).catch(async (e) => {
         if (e.code === "EEXIST")

server/lib/git-identity.js

@@ -190,6 +190,11 @@ function makeKeyPair(comment) {
   const pair = crypto.generateKeyPairSync("ed25519");
   const pub = Buffer.from(pair.publicKey.export({ format: "jwk" }).x, "base64url");
   const seed = Buffer.from(pair.privateKey.export({ format: "jwk" }).d, "base64url");
+  return encodeEd25519(seed, pub, comment);
+}
+
+/** An ed25519 key (32-byte seed + public half) in OpenSSH's own formats. */
+function encodeEd25519(seed, pub, comment) {
   const type = Buffer.from("ssh-ed25519");
   const pubBlob = Buffer.concat([sshString(type), sshString(pub)]);
   const check = crypto.randomBytes(4);
@@ -220,6 +225,182 @@ function makeKeyPair(comment) {
   };
 }
 
+/** `ssh-rsa …` for an RSA key object (private or public). */
+function rsaPublicLine(key, comment) {
+  const jwk = crypto.createPublicKey(key).export({ format: "jwk" });
+  const blob = Buffer.concat([
+    sshString(Buffer.from("ssh-rsa")),
+    mpint(Buffer.from(jwk.e, "base64url")),
+    mpint(Buffer.from(jwk.n, "base64url")),
+  ]);
+  return `ssh-rsa ${blob.toString("base64")} ${comment}\n`;
+}
+
+// ── An imported key ────────────────────────────────────────────────────────
+
+/** A pasted key file is a few KB; anything far past that is not one. */
+const IMPORT_MAX = 32 * 1024;
+const PASSPHRASE_HINT =
+  "this key has a passphrase — a commit made from the dashboard has nowhere to type it. " +
+  'Make a copy without one on your own machine (ssh-keygen -p -N "" -f <copy>) and import the copy';
+
+/** Reads SSH wire strings out of a buffer; EBADKEY on a short one. */
+function wireReader(buf) {
+  let at = 0;
+  const need = (n) => {
+    if (at + n > buf.length) throw err("EBADKEY", "not a valid SSH private key");
+  };
+  return {
+    u32() {
+      need(4);
+      const v = buf.readUInt32BE(at);
+      at += 4;
+      return v;
+    },
+    bytes() {
+      const n = this.u32();
+      need(n);
+      const v = buf.subarray(at, at + n);
+      at += n;
+      return v;
+    },
+  };
+}
+
+const b64u = (b) => Buffer.from(b).toString("base64url");
+const big = (b) => BigInt(`0x${Buffer.from(b).toString("hex") || "0"}`);
+const unbig = (n) => {
+  let h = n.toString(16);
+  if (h.length % 2) h = `0${h}`;
+  return Buffer.from(h, "hex");
+};
+/** An SSH mpint's magnitude without its sign byte. */
+const mag = (b) => (b[0] === 0 && b.length > 1 ? b.subarray(1) : b);
+
+/**
+ * An `openssh-key-v1` file (`BEGIN OPENSSH PRIVATE KEY`) as a KeyObject plus
+ * its comment. Encrypted ones are refused (EKEYPASSPHRASE): reading them
+ * needs the passphrase, and signing from the dashboard would need it again.
+ */
+function parseOpenSsh(text) {
+  const b64 = text.replace(/-----(BEGIN|END) OPENSSH PRIVATE KEY-----/g, "").replace(/\s+/g, "");
+  const buf = Buffer.from(b64, "base64");
+  const magic = Buffer.from("openssh-key-v1\0");
+  if (!buf.subarray(0, magic.length).equals(magic)) {
+    throw err("EBADKEY", "not a valid SSH private key");
+  }
+  const r = wireReader(buf.subarray(magic.length));
+  const cipher = r.bytes().toString();
+  r.bytes(); // kdf name
+  r.bytes(); // kdf options
+  if (cipher !== "none") throw err("EKEYPASSPHRASE", PASSPHRASE_HINT);
+  if (r.u32() !== 1) throw err("EBADKEY", "a key file holding one key");
+  r.bytes(); // the public blob — checked against the private half below
+  const p = wireReader(r.bytes());
+  if (p.u32() !== p.u32()) throw err("EBADKEY", "not a valid SSH private key");
+  const type = p.bytes().toString();
+  if (type === "ssh-ed25519") {
+    const pub = p.bytes();
+    const sk = p.bytes();
+    if (pub.length !== 32 || sk.length !== 64 || !sk.subarray(32).equals(pub)) {
+      throw err("EBADKEY", "not a valid SSH private key");
+    }
+    const key = crypto.createPrivateKey({
+      key: { kty: "OKP", crv: "Ed25519", d: b64u(sk.subarray(0, 32)), x: b64u(pub) },
+      format: "jwk",
+    });
+    return { key, comment: p.bytes().toString("utf8") };
+  }
+  if (type === "ssh-rsa") {
+    const n = mag(p.bytes());
+    const e = mag(p.bytes());
+    const d = mag(p.bytes());
+    const qi = mag(p.bytes());
+    const pp = mag(p.bytes());
+    const q = mag(p.bytes());
+    const D = big(d);
+    const key = crypto.createPrivateKey({
+      key: {
+        kty: "RSA",
+        n: b64u(n),
+        e: b64u(e),
+        d: b64u(d),
+        p: b64u(pp),
+        q: b64u(q),
+        dp: b64u(unbig(D % (big(pp) - 1n))),
+        dq: b64u(unbig(D % (big(q) - 1n))),
+        qi: b64u(qi),
+      },
+      format: "jwk",
+    });
+    return { key, comment: p.bytes().toString("utf8") };
+  }
+  throw err("EBADKEYTYPE", `an ${type.replace(/^ssh-/, "")} key — import an ed25519 or RSA one`);
+}
+
+/**
+ * A pasted or uploaded private key → `{type, privateKey, publicKey}` in the
+ * same formats a generated key is written in. Takes OpenSSH's own format and
+ * the PEM ones (PKCS#1, PKCS#8); refuses an encrypted key (EKEYPASSPHRASE),
+ * anything but ed25519 or RSA ≥ 2048 bits (EBADKEYTYPE), and a key whose
+ * halves do not sign and verify as one (EBADKEY).
+ */
+function parsePrivateKey(text, fallbackComment) {
+  const src = typeof text === "string" ? text.replace(/\r\n?/g, "\n").trim() : "";
+  if (!src || src.length > IMPORT_MAX || !/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/.test(src)) {
+    throw err(
+      "EBADKEY",
+      /^ssh-|^ecdsa-/.test(src)
+        ? "that is a PUBLIC key (.pub) — import the private key file next to it"
+        : "not an SSH private key — the file starts with -----BEGIN … PRIVATE KEY-----"
+    );
+  }
+  let key;
+  let comment = "";
+  if (/-----BEGIN OPENSSH PRIVATE KEY-----/.test(src)) {
+    ({ key, comment } = parseOpenSsh(src));
+  } else {
+    if (/ENCRYPTED/.test(src)) throw err("EKEYPASSPHRASE", PASSPHRASE_HINT);
+    try {
+      key = crypto.createPrivateKey(src);
+    } catch (e) {
+      if (/passphrase/i.test(String(e?.code || e?.message))) {
+        throw err("EKEYPASSPHRASE", PASSPHRASE_HINT);
+      }
+      throw err("EBADKEY", "not a valid SSH private key");
+    }
+  }
+  const kind = key.asymmetricKeyType;
+  if (kind !== "ed25519" && kind !== "rsa") {
+    throw err("EBADKEYTYPE", `an ${kind || "unknown"} key — import an ed25519 or RSA one`);
+  }
+  if (kind === "rsa" && (key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) {
+    throw err("EBADKEYTYPE", "an RSA key under 2048 bits — too weak to sign with");
+  }
+  // The halves belong together: a mangled paste fails here, not at commit time.
+  const probe = Buffer.from("agenthub key check");
+  const hash = kind === "rsa" ? "sha256" : null;
+  if (!crypto.verify(hash, probe, crypto.createPublicKey(key), crypto.sign(hash, probe, key))) {
+    throw err("EBADKEY", "the key's private and public halves do not match");
+  }
+  const label =
+    String(comment || fallbackComment || "agenthub")
+      .replace(/[^\w.@+-]/g, "")
+      .slice(0, 64) || "agenthub";
+  if (kind === "ed25519") {
+    const jwk = key.export({ format: "jwk" });
+    return {
+      type: "ed25519",
+      ...encodeEd25519(Buffer.from(jwk.d, "base64url"), Buffer.from(jwk.x, "base64url"), label),
+    };
+  }
+  return {
+    type: "rsa",
+    privateKey: key.export({ type: "pkcs1", format: "pem" }),
+    publicKey: rsaPublicLine(key, label),
+  };
+}
+
 /** `SHA256:…` as `ssh-keygen -l` prints it, from a public key line. */
 function fingerprint(publicKey) {
   const blob = Buffer.from(String(publicKey).trim().split(/\s+/)[1] || "", "base64");
@@ -321,6 +502,243 @@ async function generateSshKey(
   return sshKeysInfo(account).find((k) => k.id === id) ?? null;
 }
 
+/**
+ * Import a key the user already has (`privateKey`: the file's text) as a
+ * NAMED key beside the generated ones — `name`, else `signing`, `signing-2`…
+ * Written exactly like a generated key (0600, as the member), so it serves
+ * clones and pushes too; only its public half is ever returned. The same key
+ * twice is EEXISTS, naming the key that holds it.
+ */
+async function importSshKey(account, { privateKey, name = null, comment } = {}) {
+  const parsed = parsePrivateKey(privateKey, comment);
+  const keys = currentKeys(account);
+  const fp = fingerprint(parsed.publicKey);
+  const twin = keys.find((k) => fingerprint(k.publicKey) === fp);
+  if (twin) throw err("EEXISTS", `this key is already here as ${twin.name ?? twin.type}`);
+  let keyName = name == null || name === "" ? null : String(name).trim().toLowerCase();
+  if (keyName === null) {
+    keyName = "signing";
+    for (let n = 2; keys.some((k) => k.name === keyName); n++) keyName = `signing-${n}`;
+  }
+  if (!KEY_NAME_RE.test(keyName)) {
+    throw err("EBADKEYNAME", "a key name of lowercase letters, digits and -, up to 32");
+  }
+  if (keys.some((k) => k.name === keyName))
+    throw err("EEXISTS", `a key named ${keyName} already exists`);
+  if (keys.length >= MAX_KEYS) throw err("ETOOMANYKEYS", `at most ${MAX_KEYS} SSH keys`);
+  const id = keyIdFor(parsed.type, keyName);
+  const file = path.join(paths(account).sshDir, id);
+  writeText(account, file, parsed.privateKey, { secret: true });
+  writeText(account, `${file}.pub`, parsed.publicKey, { secret: false });
+  if (account.kind === "member" || (await terminalSshState(account)) === "on") {
+    await setTerminalSsh(account, true).catch(() => {});
+  }
+  return sshKeysInfo(account).find((k) => k.id === id) ?? null;
+}
+
+// ── Commit signing (`~/.gitconfig` gpg.format / user.signingkey) ───────────
+
+/** One global git config value, or "" when unset. */
+async function globalGet(account, key) {
+  const { git } = require("./worktree");
+  return git(homeOf(account), ["config", "--global", "--get", key]).then(
+    (r) => r.stdout.trim(),
+    () => ""
+  );
+}
+
+/**
+ * Whether the account's commits are signed with one of ITS AgentHub keys:
+ * `{state: "on", key}` (gpg.format ssh, user.signingkey = that key's private
+ * file — ssh-keygen signs with the private file, a `.pub` needs an agent the
+ * dashboard has not got — and commit.gpgsign true), `{state: "off"}`, or
+ * `{state: "foreign", path}` when the user set a signing key of their own
+ * (never touched without `replace`).
+ */
+async function signingState(account) {
+  const signingKey = await globalGet(account, "user.signingkey");
+  if (!signingKey) return { state: "off", key: null, path: null };
+  const k = currentKeys(account).find((x) => x.file === signingKey);
+  // Not one of our keys — the user's own, or one of ours deleted by hand
+  // (commits then fail): either way show the path, so a key can be picked.
+  if (!k) return { state: "foreign", key: null, path: signingKey };
+  const on =
+    (await globalGet(account, "gpg.format")) === "ssh" &&
+    (await globalGet(account, "commit.gpgsign")) === "true";
+  return { state: on ? "on" : "off", key: on ? k.id : null, path: null };
+}
+
+/**
+ * Sign every commit of the account with key `id` (null = stop signing).
+ * Over a signing key the user set themselves only with `replace`
+ * (EFOREIGNSIGN); off removes only our own settings. No value is a secret —
+ * the key's PATH crosses sudo's argv, never its content.
+ */
+async function setSigning(account, { id = null, replace = false, clearForeign = false } = {}) {
+  const { git } = require("./worktree");
+  const home = homeOf(account);
+  const state = await signingState(account);
+  const unset = (key) =>
+    git(home, ["config", "--global", "--unset", key]).catch(() => {
+      /* already unset */
+    });
+  if (id == null) {
+    // The user's own setup is left alone unless they asked to take it out
+    // (`clearForeign`): only the three settings go, never their key file.
+    if (state.state === "foreign" && !clearForeign) return state;
+    if ((await globalGet(account, "user.signingkey")) !== "") {
+      await unset("commit.gpgsign");
+      await unset("user.signingkey");
+      await unset("gpg.format");
+    }
+    return signingState(account);
+  }
+  const k = currentKeys(account).find((x) => x.id === id);
+  if (!k) throw err("ENOKEY", "no such SSH key");
+  if (state.state === "foreign" && !replace) {
+    throw err(
+      "EFOREIGNSIGN",
+      `your ~/.gitconfig already signs with ${state.path} — confirm to switch to ${k.name ?? k.type}`
+    );
+  }
+  await git(home, ["config", "--global", "gpg.format", "ssh"]);
+  await git(home, ["config", "--global", "user.signingkey", k.file]);
+  await git(home, ["config", "--global", "commit.gpgsign", "true"]);
+  return signingState(account);
+}
+
+// ── Commit signing per workspace (`includeIf "gitdir:…"`) ──────────────────
+//
+// A workspace is signed by a small config file of OURS per workspace
+// (`lane-<id>.gitconfig`: gpg.format ssh, user.signingkey, commit.gpgsign),
+// pulled into the account's `~/.gitconfig` by `includeIf "gitdir:<dir>"` for
+// the workspace's own git dir and for the git dirs of the worktrees its
+// sessions make (`ah-<id>-*`, pty-run.js). Every git that reads the account's
+// config — the terminal, the Changes panel, an agent — then signs there and
+// nowhere else; nothing is written into the user's repository.
+
+const LANE_SIGN_RE = /^lane-(\d+)\.gitconfig$/;
+
+/** Where the per-workspace files live: ours, beside the account's keys. */
+function signingDir(account) {
+  return account.kind === "member"
+    ? path.join(paths(account).base, "signing")
+    : path.join(getClaudeHome(), "agenthub-signing");
+}
+const laneSignFile = (account, laneId) =>
+  path.join(signingDir(account), `lane-${Number(laneId)}.gitconfig`);
+
+/** `[{key, value}]` of the `includeIf.*.path` lines naming one of OUR files. */
+async function ourIncludes(account) {
+  const { git } = require("./worktree");
+  const out = await git(homeOf(account), [
+    "config",
+    "--global",
+    "--null",
+    "--get-regexp",
+    "^includeif\\..*\\.path$",
+  ]).then(
+    (r) => r.stdout,
+    () => ""
+  );
+  const dir = signingDir(account);
+  const rows = [];
+  // `--null`: "key\nvalue\0" — a git dir or a path may hold spaces.
+  for (const rec of out.split("\0")) {
+    const at = rec.indexOf("\n");
+    if (at <= 0) continue;
+    const key = rec.slice(0, at);
+    const value = rec.slice(at + 1);
+    if (path.dirname(value) === dir && LANE_SIGN_RE.test(path.basename(value))) {
+      rows.push({ key, value });
+    }
+  }
+  return rows;
+}
+
+/** Take every include of `file` out of `~/.gitconfig` (the user's own includes stay). */
+async function dropIncludes(account, file) {
+  const { git } = require("./worktree");
+  for (const r of await ourIncludes(account)) {
+    if (r.value !== file) continue;
+    await git(homeOf(account), [
+      "config",
+      "--global",
+      "--fixed-value",
+      "--unset-all",
+      r.key,
+      r.value,
+    ]).catch(() => {});
+  }
+}
+
+/** The key file a workspace file signs with (its `signingkey` line), or null. */
+function laneSignKeyFile(account, file) {
+  const text = readText(account, file) || "";
+  const m = /^\s*signingkey\s*=\s*"?(.*?)"?\s*$/m.exec(text);
+  return m ? m[1].replace(/\\(["\\])/g, "$1") : null;
+}
+
+/**
+ * Which workspaces sign their commits, and with which key:
+ * `[{laneId, key}]` (`key` null when the key file it names is gone).
+ */
+async function laneSigningList(account) {
+  const keys = currentKeys(account);
+  const seen = new Map();
+  for (const r of await ourIncludes(account)) {
+    const laneId = Number(LANE_SIGN_RE.exec(path.basename(r.value))[1]);
+    if (seen.has(laneId)) continue;
+    const keyFile = laneSignKeyFile(account, r.value);
+    seen.set(laneId, keys.find((k) => k.file === keyFile)?.id ?? null);
+  }
+  return [...seen].map(([laneId, key]) => ({ laneId, key })).sort((a, b) => a.laneId - b.laneId);
+}
+
+const gitQuote = (v) => `"${String(v).replace(/(["\\])/g, "\\$1")}"`;
+
+/**
+ * Sign the commits of workspace `laneId` (folder `cwd`) with key `id`, or stop
+ * (`id` null). The git dirs come from git itself, run in the workspace's
+ * folder as its account — never from the request. ENOREPO when the folder is
+ * not a git repository.
+ */
+async function setLaneSigning(account, { laneId, cwd, id = null }) {
+  const n = Number(laneId);
+  if (!Number.isSafeInteger(n) || n <= 0) throw err("ENOTFOUND", "no such workspace");
+  const file = laneSignFile(account, n);
+  await dropIncludes(account, file);
+  if (id == null) {
+    removeFile(account, file);
+    return;
+  }
+  const k = currentKeys(account).find((x) => x.id === id);
+  if (!k) throw err("ENOKEY", "no such SSH key");
+  const { git } = require("./worktree");
+  const rev = (args) => git(cwd, ["rev-parse", ...args]).then((r) => r.stdout.trim());
+  let gitDir;
+  let commonDir;
+  try {
+    gitDir = await rev(["--absolute-git-dir"]);
+    commonDir = await rev(["--path-format=absolute", "--git-common-dir"]);
+  } catch {
+    throw err("ENOREPO", "this workspace's folder is not a git repository");
+  }
+  writeText(
+    account,
+    file,
+    `# Written by AgentHub: commit signing for workspace ${n} (Settings → Git).\n` +
+      `[gpg]\n\tformat = ssh\n[user]\n\tsigningkey = ${gitQuote(k.file)}\n` +
+      `[commit]\n\tgpgsign = true\n[tag]\n\tgpgsign = false\n`,
+    { secret: false }
+  );
+  const add = (pattern) =>
+    git(homeOf(account), ["config", "--global", "--add", `includeIf.gitdir:${pattern}.path`, file]);
+  await add(gitDir);
+  // The worktrees this workspace's sessions make (`claude --worktree=ah-<id>-…`).
+  await add(path.join(commonDir, "worktrees", `ah-${n}-*`));
+}
+
 /**
  * Delete one key — `{id}`, or the DEFAULT key of `{type}` — or every key when
  * neither is given; false when there was none. A login naming a deleted key
@@ -335,6 +753,18 @@ async function removeSshKey(account, which) {
     id != null ? k.id === id : type != null ? k.id === KEY_FILES[type] : true
   );
   if (!gone.length) return false;
+  // Commits signed with a key about to go would all fail: stop signing first —
+  // account-wide, and in every workspace that signs with it.
+  const signingKey = await globalGet(account, "user.signingkey");
+  if (signingKey && gone.some((k) => k.file === signingKey)) {
+    await setSigning(account, { id: null }).catch(() => {});
+  }
+  const goneIds = new Set(gone.map((k) => k.id));
+  for (const l of await laneSigningList(account)) {
+    if (goneIds.has(l.key)) {
+      await setLaneSigning(account, { laneId: l.laneId, id: null }).catch(() => {});
+    }
+  }
   for (const k of gone) {
     removeFile(account, k.file);
     removeFile(account, `${k.file}.pub`);
@@ -1133,6 +1563,12 @@ module.exports = {
   sshKeyInfo,
   sshKeysInfo,
   generateSshKey,
+  importSshKey,
+  parsePrivateKey,
+  signingState,
+  laneSigningList,
+  setLaneSigning,
+  setSigning,
   removeSshKey,
   terminalSshCommand,
   terminalSshState,

server/lib/member-policy.js

@@ -0,0 +1,56 @@
+/**
+ * @file member-policy.js
+ * @description Server mode, one Linux user per account (S3): the admin's
+ * switch for what members' Claude may run on this box — today whether test
+ * runners and container commands are allowed (`allowTests`, off by default).
+ * Kept in `<app root>/member-policy.json` (/opt/agenthub/app, host-owned,
+ * world-readable), because `scripts/member-guard.js` runs AS the member and
+ * reads it from there; a missing or unreadable file means the default, so
+ * tests stay blocked unless an admin turned them on.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const FILE = "member-policy.json";
+const DEFAULTS = Object.freeze({ allowTests: false });
+
+const appRoot = () => process.env.AGENTHUB_APP_ROOT || "/opt/agenthub/app";
+const file = () => path.join(appRoot(), FILE);
+
+/** The policy in force (defaults for anything missing or unreadable). */
+function read(p = file()) {
+  try {
+    const j = JSON.parse(fs.readFileSync(p, "utf8"));
+    return { allowTests: j?.allowTests === true };
+  } catch {
+    return { ...DEFAULTS };
+  }
+}
+
+/** Does it apply here? Only S3 runs members' panes as their own accounts. */
+function available() {
+  try {
+    return require("./linux-accounts").s3Enabled();
+  } catch {
+    return false;
+  }
+}
+
+function state() {
+  return { available: available(), ...read() };
+}
+
+/** Writes the switch (atomically, 0644: members' hooks read it). */
+function setAllowTests(on) {
+  const next = { ...read(), allowTests: on === true };
+  fs.mkdirSync(appRoot(), { recursive: true });
+  const tmp = `${file()}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 0o644 });
+  fs.chmodSync(tmp, 0o644);
+  fs.renameSync(tmp, file());
+  return state();
+}
+
+module.exports = { FILE, DEFAULTS, read, available, state, setAllowTests };

server/lib/pty-run.js

@@ -49,6 +49,8 @@ const RUN_ID_RE = /^agenthub-lane-(\d+)(?:-([1-9]))?$/;
 /** Highest pane slot a lane may use: ten sessions per workspace, 0–9 (the
  *  Workspace groups them into tabs of up to four split panes each). */
 const MAX_PANE_SLOT = 9;
+// Lines a fullscreen `claude` scrolls per wheel report (see spawnRun's env).
+const CLAUDE_SCROLL_SPEED = "5";
 const EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh", "max"]);
 // `auto` is the CLI's own default-ish mode (`claude --permission-mode auto`):
 // it asks only for what its classifier reads as risky. `default` is kept for
@@ -124,6 +126,30 @@ function laneIdFromRunId(id) {
   return m ? Number(m[1]) : null;
 }
 
+/**
+ * S3: a member runs at most `MAX_AI_SESSIONS` AI sessions at once (default 4,
+ * server.conf), counted from the processes their account runs right now —
+ * a `claude` typed into a Terminal tab counts, the tab itself does not
+ * (ai-procs.js; scripts/member-guard.js refuses the prompts of one started
+ * past the limit by hand). The host account is an admin's and not limited.
+ * @throws ESESSIONLIMIT
+ */
+function assertSessionRoom(laneId) {
+  const account = require("./run-as").accountForLane(laneId);
+  if (!account) return;
+  const procs = require("./ai-procs");
+  const limit = procs.sessionLimit();
+  if (!limit) return;
+  const running = procs.sessionsOf(account.uid).length;
+  if (running >= limit) {
+    throw makeErr(
+      "ESESSIONLIMIT",
+      `AgentHub: you are running ${running} AI sessions — at most ${limit} at once on this server. ` +
+        "Close one (end its pane) and start again."
+    );
+  }
+}
+
 function makeErr(code, message) {
   const err = new Error(message);
   err.code = code;
@@ -473,6 +499,7 @@ function spawnRun(args) {
   assertCwdAccount(laneId, cwd); // ECWDACCOUNT
   // Server mode: an owner over their spend quota starts nothing new (user-quota.js).
   require("./user-quota").assertSpawnAllowed(laneOwner); // EQUOTA
+  assertSessionRoom(laneId); // ESESSIONLIMIT
   const proxyProfile = resolveProxy(tool, proxy, laneOwner); // EBADPROXY, EUNSUPPORTED
   // A Claude session on the vendor's own API runs on the least-loaded pool
   // account, if the admin added any (claude-pool.js) — or the one the
@@ -663,6 +690,15 @@ function spawnRun(args) {
     // (routes/sessions.js sessionOutline). A user's settings.json `env` still
     // wins, so `"0"` there turns them back off.
     ...(entry.launcher === "claude" ? { CLAUDE_CODE_ENABLE_TODO_TOOLS: "1" } : {}),
+    // Fullscreen claude scrolls by itself, and through tmux it cannot tell it
+    // runs in xterm.js (XTVERSION answers tmux), so it takes ONE line per wheel
+    // report — while xterm.js sends one report per notch (and damps a trackpad
+    // ×0.3). A notch moved a single line. CLAUDE_CODE_SCROLL_SPEED is Claude's
+    // own multiplier; the dashboard's env or the user's settings.json `env`
+    // (or /config → Scroll speed) still wins.
+    ...(entry.launcher === "claude" && !process.env.CLAUDE_CODE_SCROLL_SPEED
+      ? { CLAUDE_CODE_SCROLL_SPEED: CLAUDE_SCROLL_SPEED }
+      : {}),
     // No CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN: an inline claude duplicated its
     // output whenever the pane narrowed (tmux re-wraps the full-width rules and
     // pushes lines into history its redraw cannot clear). The user's own

server/lib/upload-staging.js

@@ -0,0 +1,252 @@
+/**
+ * @file Resumable uploads for the File Explorer: an upload's bytes are sent in
+ * parts and kept on the HOST's disk under
+ * `<data dir>/upload-staging/<user key>/<id>/` (0700/0600; never in a member's
+ * home), so a restart of the dashboard — an update, a manual restart, a crash —
+ * only costs the part in flight: the browser asks how much arrived (`status`)
+ * and sends the rest. Only when every byte is here is the file written where
+ * it goes, by the SAME `upload`/`uploadBatch` code (and guards) as a one-shot
+ * upload, reading the staged file instead of the request (`commit`).
+ *
+ * `<id>` is the browser's own random name for one upload; ids live per user
+ * key, so one user can never read, extend or commit another's. A part must
+ * start exactly where the staged bytes end (`EOFFSET` with `received`), one
+ * request per id at a time (`EBUSY`), never past the `total` announced first.
+ * A committed upload keeps its answer (`result.json`) and drops its bytes, so
+ * a commit whose answer a restart swallowed is answered again, never written
+ * twice; a failed commit (a taken name, say) keeps the bytes for a retry with
+ * another `conflict`. At most `MAX_OPEN` unfinished uploads per user; anything
+ * untouched for `KEEP_MS` is swept.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { Transform } = require("node:stream");
+const { pipeline } = require("node:stream/promises");
+
+const { getDataDir } = require("./claude-home");
+
+/** The largest upload (the browser sends a whole file — or a batch — under one id). */
+const TOTAL_MAX = 512 * 1024 * 1024;
+/** The largest part one request may carry. */
+const PART_MAX = 16 * 1024 * 1024;
+const MAX_OPEN = 8;
+const KEEP_MS = 24 * 60 * 60 * 1000;
+
+const ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
+const KEY_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+const bad = (code, message, extra = {}) => Object.assign(new Error(message), { code, ...extra });
+
+/** Ids (`<key>/<id>`) a request in THIS process is working on. */
+const busy = new Set();
+
+const root = () => path.join(getDataDir(), "upload-staging");
+
+function dirOf(userKey, id) {
+  const key = String(userKey ?? "");
+  if (!KEY_RE.test(key)) throw bad("EBADBODY", "no user for this upload");
+  if (typeof id !== "string" || !ID_RE.test(id)) {
+    throw bad("EBADBODY", "an upload id is 16–64 letters, digits, '-' or '_'");
+  }
+  return { key, id, dir: path.join(root(), key, id), lock: `${key}/${id}` };
+}
+
+const dataFile = (d) => path.join(d.dir, "data");
+const metaFile = (d) => path.join(d.dir, "meta.json");
+const resultFile = (d) => path.join(d.dir, "result.json");
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeJson(file, value) {
+  const tmp = `${file}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value), { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+const sizeOf = (d) => {
+  try {
+    return fs.statSync(dataFile(d)).size;
+  } catch {
+    return 0;
+  }
+};
+
+function int(v, name, max) {
+  const n = typeof v === "string" && /^\d+$/.test(v) ? Number(v) : v;
+  if (!Number.isSafeInteger(n) || n < 0 || n > max) throw bad("EBADBODY", `bad ${name}`);
+  return n;
+}
+
+/** Drop uploads untouched for KEEP_MS (every user's — the store is one). */
+function sweep(now = Date.now()) {
+  let keys = [];
+  try {
+    keys = fs.readdirSync(root());
+  } catch {
+    return;
+  }
+  for (const key of keys) {
+    let ids = [];
+    try {
+      ids = fs.readdirSync(path.join(root(), key));
+    } catch {
+      continue;
+    }
+    for (const id of ids) {
+      if (busy.has(`${key}/${id}`)) continue;
+      const dir = path.join(root(), key, id);
+      try {
+        if (now - fs.statSync(dir).mtimeMs > KEEP_MS)
+          fs.rmSync(dir, { recursive: true, force: true });
+      } catch {
+        /* gone meanwhile */
+      }
+    }
+  }
+}
+
+/** Unfinished uploads of `key` (a committed one keeps only its answer). */
+function openCount(key) {
+  let ids = [];
+  try {
+    ids = fs.readdirSync(path.join(root(), key));
+  } catch {
+    return 0;
+  }
+  return ids.filter((id) => !fs.existsSync(path.join(root(), key, id, "result.json"))).length;
+}
+
+/** Touch the folder so `sweep` counts from the last part, not the first. */
+function touch(d) {
+  const now = new Date();
+  try {
+    fs.utimesSync(d.dir, now, now);
+  } catch {
+    /* best effort */
+  }
+}
+
+/** `{received, total, done}` of one upload (`received: 0`, `total: null` when unknown). */
+function status(userKey, id) {
+  const d = dirOf(userKey, id);
+  const meta = readJson(metaFile(d));
+  if (!meta) return { received: 0, total: null, done: false };
+  const done = fs.existsSync(resultFile(d));
+  return { received: done ? meta.total : sizeOf(d), total: meta.total, done };
+}
+
+/**
+ * Append the request `stream` at `offset` of upload `id` (of `total` bytes in
+ * all). Returns `{received, total}`.
+ */
+async function putPart(userKey, id, { offset, total, stream }) {
+  const d = dirOf(userKey, id);
+  const at = int(offset, "offset", TOTAL_MAX);
+  const all = int(total, "total", TOTAL_MAX);
+  if (busy.has(d.lock)) throw bad("EBUSY", "this upload is already receiving a part");
+  busy.add(d.lock);
+  try {
+    let meta = readJson(metaFile(d));
+    if (!meta) {
+      sweep();
+      if (openCount(d.key) >= MAX_OPEN) {
+        throw bad("ETOOMANY", `at most ${MAX_OPEN} unfinished uploads at a time`);
+      }
+      fs.mkdirSync(d.dir, { recursive: true, mode: 0o700 });
+      meta = { total: all, createdAt: new Date().toISOString() };
+      writeJson(metaFile(d), meta);
+    }
+    if (meta.total !== all) throw bad("EBADBODY", `this upload is ${meta.total} bytes`);
+    if (fs.existsSync(resultFile(d))) return { received: all, total: all };
+    const have = sizeOf(d);
+    if (at !== have) {
+      throw bad("EOFFSET", `this upload has ${have} bytes, not ${at}`, { received: have });
+    }
+    const room = Math.min(PART_MAX, all - have);
+    let n = 0;
+    const cap = new Transform({
+      transform(chunk, _enc, cb) {
+        n += chunk.length;
+        if (n > room) return cb(bad("ETOOBIG", "this part goes past the upload's end"));
+        cb(null, chunk);
+      },
+    });
+    // A part cut short leaves what arrived: the next one starts from there.
+    await pipeline(stream, cap, fs.createWriteStream(dataFile(d), { flags: "a", mode: 0o600 }));
+    touch(d);
+    return { received: sizeOf(d), total: all };
+  } finally {
+    busy.delete(d.lock);
+  }
+}
+
+/**
+ * Write a fully staged upload: `write(stream, size)` is the one-shot upload's
+ * own code, given the staged bytes; it answers `{status, body}`. A commit
+ * already made answers its stored answer again; a failed one keeps the bytes.
+ */
+async function commit(userKey, id, write) {
+  const d = dirOf(userKey, id);
+  const meta = readJson(metaFile(d));
+  if (!meta) throw bad("ENOFILE", "no such upload — send it again");
+  if (busy.has(d.lock)) throw bad("EBUSY", "this upload is still being written");
+  busy.add(d.lock);
+  try {
+    const stored = readJson(resultFile(d));
+    if (stored) return stored;
+    const have = sizeOf(d);
+    if (have !== meta.total) {
+      throw bad("EINCOMPLETE", `this upload has ${have} of ${meta.total} bytes`, {
+        received: have,
+      });
+    }
+    const stream = fs.createReadStream(dataFile(d));
+    let out;
+    try {
+      out = await write(stream, have);
+    } finally {
+      stream.destroy();
+    }
+    writeJson(resultFile(d), out);
+    fs.rmSync(dataFile(d), { force: true });
+    touch(d);
+    return out;
+  } finally {
+    busy.delete(d.lock);
+  }
+}
+
+/**
+ * Forget one upload (the browser stopped it, or has its answer). Also while a
+ * part is still arriving: a Stop drops the request, and the part writes on
+ * into a file no longer listed — never refused, or the stopped upload would
+ * hold one of MAX_OPEN for a day.
+ */
+function drop(userKey, id) {
+  const d = dirOf(userKey, id);
+  fs.rmSync(d.dir, { recursive: true, force: true });
+  return { dropped: true };
+}
+
+module.exports = {
+  status,
+  putPart,
+  commit,
+  drop,
+  sweep,
+  root,
+  TOTAL_MAX,
+  PART_MAX,
+  MAX_OPEN,
+  KEEP_MS,
+};

server/openapi-extra/ai-tools.js

@@ -173,6 +173,43 @@ const paths = {
       },
     },
   },
+  "/api/ai-tools/member-policy": {
+    get: {
+      tags: ["AI Tools"],
+      summary: "What members' Claude may run on this server",
+      description:
+        "Server mode with per-user accounts (S3): whether members' Claude may run test runners and container commands (`allowTests`, off by default). Kept in `/opt/agenthub/app/member-policy.json` and enforced by the members' synchronous PreToolUse hook (scripts/member-guard.js).",
+      operationId: "aiToolsMemberPolicy",
+      responses: {
+        200: { description: "`{available, allowTests}`." },
+      },
+    },
+    put: {
+      tags: ["AI Tools"],
+      summary: "Allow or block members' test runs",
+      description:
+        "An admin's switch. Takes effect at the next Bash call of every member's Claude, no restart. Same-origin only; audited.",
+      operationId: "aiToolsSetMemberPolicy",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              required: ["allowTests"],
+              properties: { allowTests: { type: "boolean" } },
+            },
+          },
+        },
+      },
+      responses: {
+        200: { description: "The new state, as GET." },
+        400: { description: "EBADFIELD" },
+        403: { description: "Not an admin" },
+        409: { description: "ENOS3 — not server mode with per-user accounts" },
+      },
+    },
+  },
   "/api/ai-tools/{id}": {
     put: {
       tags: ["AI Tools"],

server/openapi-extra/auth.js

@@ -21,7 +21,7 @@
  *   - POST /api/me/avatar/url (Auth) — the picture as a link, redirected to
  *   - GET/PATCH /api/users/{id} (Auth) — the Users page's Edit user form (its `quota` too)
  *   - PUT /api/users/quota-default, GET /api/me/quota (Auth) — spend quotas per user
- *   - GET /api/users/{id}/avatar (Auth) — one account's picture (admin/analyst)
+ *   - GET /api/users/{id}/avatar (Auth) — one account's picture (every account)
  *   - GET /api/users/tmux, POST /api/users/{id}/tmux-restart, POST /api/users/tmux-restart-idle
  *     (Auth) — each member's own tmux server and an admin's restart of it (S3)
  * Exports `{ tags, schemas, paths }`, combined into the spec by
@@ -731,12 +731,11 @@ const paths = {
     get: {
       tags: ["Auth"],
       operationId: "getUserAvatar",
-      summary: "One account's picture, for the sidebar's owner groups (admin/analyst)",
+      summary: "One account's picture, for owner groups and System Health (every signed-in account)",
       parameters: [{ name: "id", in: "path", required: true, schema: { type: "integer" } }],
       responses: {
         200: { description: "The image (PNG, JPEG, GIF or WebP)" },
         302: { description: "Redirect to that account's avatar link" },
-        403: err("EADMIN — a developer"),
         404: err("ENOAVATAR"),
       },
     },

server/openapi-extra/files.js

@@ -21,7 +21,7 @@ const tags = [
 ];
 
 const errorCodes =
-  "400 EBADPATH/EBADNAME, 403 ESECRET/EFOREIGN/EREADONLY (another user's home)/EBADORIGIN, 404 ENOFILE/ENOHOME, 409 EEXISTS (with `error.names`)/EUPGRADE/EMEMBERGONE, 413 ETOOBIG.";
+  "400 EBADPATH/EBADNAME, 403 ESECRET/EFOREIGN/EREADONLY (another user's home)/EBADORIGIN, 404 ENOFILE/ENOHOME, 409 EEXISTS (with `error.names`)/EUPGRADE/EMEMBERGONE, 413 ETOOBIG; a resumable upload adds 409 EOFFSET/EINCOMPLETE (with `error.received`)/EBUSY and 429 ETOOMANY.";
 
 const schemas = {
   FsEntry: {
@@ -141,12 +141,109 @@ const OPS = [
       parameters: [
         { name: "path", in: "query", required: true, schema: { type: "string" } },
         { name: "conflict", in: "query", schema: conflict },
+        {
+          name: "staged",
+          in: "query",
+          schema: { type: "string" },
+          description:
+            "Write the bytes sent before through `/upload-part` under this upload id instead of a body. A commit made before answers its stored answer again; a failed one keeps the bytes for a retry.",
+        },
+      ],
+      body: {
+        required: false,
+        content: { "application/octet-stream": { schema: { type: "string", format: "binary" } } },
+      },
+      status: 201,
+    },
+  ],
+  [
+    "get",
+    "/upload-part",
+    "How much of a resumable upload arrived",
+    {
+      opId: "UploadPartStatus",
+      note: "`{received, total, done}` for the caller's own upload id (`received: 0, total: null` when unknown). The browser asks this after the dashboard came back, then sends the rest.",
+      parameters: [
+        {
+          name: "upload",
+          in: "query",
+          required: true,
+          schema: { type: "string", pattern: "^[A-Za-z0-9_-]{16,64}$" },
+        },
+      ],
+      ok: {
+        description: "`{received, total, done}`",
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                received: { type: "integer" },
+                total: { type: "integer", nullable: true },
+                done: { type: "boolean" },
+              },
+            },
+          },
+        },
+      },
+    },
+  ],
+  [
+    "post",
+    "/upload-part",
+    "Send one part of a resumable upload (≤ 16 MB a part, 512 MB in all)",
+    {
+      opId: "UploadPart",
+      note: "Raw bytes appended at `offset` to the caller's upload `upload` of `total` bytes, staged on the host (`<data dir>/upload-staging/`) until `/upload` or `/upload-batch` names it with `?staged=`. A part must start where the staged bytes end (409 EOFFSET with `error.received`), one at a time per id (409 EBUSY); a part cut short keeps what arrived. At most 8 unfinished uploads per user (429 ETOOMANY); one untouched for a day is swept.",
+      parameters: [
+        {
+          name: "upload",
+          in: "query",
+          required: true,
+          schema: { type: "string", pattern: "^[A-Za-z0-9_-]{16,64}$" },
+        },
+        { name: "offset", in: "query", required: true, schema: { type: "integer", minimum: 0 } },
+        { name: "total", in: "query", required: true, schema: { type: "integer", minimum: 0 } },
       ],
       body: {
         required: true,
         content: { "application/octet-stream": { schema: { type: "string", format: "binary" } } },
       },
-      status: 201,
+      ok: {
+        description: "`{received, total}`",
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: { received: { type: "integer" }, total: { type: "integer" } },
+            },
+          },
+        },
+      },
+    },
+  ],
+  [
+    "delete",
+    "/upload-part",
+    "Forget a resumable upload's staged bytes",
+    {
+      opId: "UploadPartDrop",
+      parameters: [
+        {
+          name: "upload",
+          in: "query",
+          required: true,
+          schema: { type: "string", pattern: "^[A-Za-z0-9_-]{16,64}$" },
+        },
+      ],
+      ok: {
+        description: "`{dropped: true}`",
+        content: {
+          "application/json": {
+            schema: { type: "object", properties: { dropped: { type: "boolean" } } },
+          },
+        },
+      },
     },
   ],
   [
@@ -178,9 +275,16 @@ const OPS = [
       parameters: [
         { name: "dir", in: "query", schema: { type: "string", default: "" } },
         { name: "conflict", in: "query", schema: conflict },
+        {
+          name: "staged",
+          in: "query",
+          schema: { type: "string" },
+          description:
+            "Write the bytes sent before through `/upload-part` under this upload id instead of a body. A commit made before answers its stored answer again; a failed one keeps the bytes for a retry.",
+        },
       ],
       body: {
-        required: true,
+        required: false,
         content: { "application/octet-stream": { schema: { type: "string", format: "binary" } } },
       },
       status: 201,
@@ -233,7 +337,7 @@ function operations(prefix, idParam, opPrefix, note) {
       tags: ["Files"],
       summary,
       description: `${note} ${x.note ? `${x.note} ` : ""}${errorCodes}`,
-      operationId: `${opPrefix}${sub.replace(/[/-](\w)/g, (_, c) => c.toUpperCase())}`,
+      operationId: `${opPrefix}${x.opId || sub.replace(/[/-](\w)/g, (_, c) => c.toUpperCase())}`,
       parameters: [idParam, ...(x.parameters || [])],
       ...(x.body ? { requestBody: x.body } : {}),
       responses: { [x.status || 200]: x.ok || { description: "Done." } },
@@ -459,6 +563,71 @@ const paths = {
       responses: { 200: { description: "The identity." } },
     },
   },
+  "/api/me/git/ssh-key/import": {
+    post: {
+      tags: ["Git identity"],
+      summary:
+        "Import a private key the user already has as a named key; with `sign`, sign commits with it at once",
+      operationId: "importSshKey",
+      requestBody: json(
+        {
+          privateKey: { type: "string", description: "The key file's text (OpenSSH or PEM)." },
+          name: { type: "string", pattern: "^[a-z0-9][a-z0-9-]{0,31}$" },
+          sign: { type: "boolean" },
+          replace: { type: "boolean" },
+        },
+        ["privateKey"]
+      ),
+      responses: {
+        201: {
+          description:
+            "The identity, plus `imported` (the key's public half) and `signError` (a refused `sign`, else null).",
+        },
+        400: { description: "EBADKEY / EKEYPASSPHRASE / EBADKEYTYPE / EBADKEYNAME" },
+        409: { description: "EEXISTS (the same key, or the name is taken) / ETOOMANYKEYS" },
+      },
+    },
+  },
+  "/api/me/git/signing": {
+    put: {
+      tags: ["Git identity"],
+      summary:
+        "Sign every commit with one of the account's keys (`key`: its id), or stop (`key: null`)",
+      operationId: "setCommitSigning",
+      description:
+        "The account-wide setting (every repository of the account). `clearForeign: true` with `key: null` also takes out a signing setup the user made themselves — the three settings only, never their key file. Per workspace: `PUT /api/me/git/signing/lane`.",
+      requestBody: json({
+        key: { type: "string", nullable: true },
+        replace: { type: "boolean" },
+        clearForeign: { type: "boolean" },
+      }),
+      responses: {
+        200: { description: "The identity; `signing.state` is on, off or foreign." },
+        400: { description: "ENOKEY" },
+        409: { description: "EFOREIGNSIGN — ~/.gitconfig already signs with a key of its own." },
+      },
+    },
+  },
+  "/api/me/git/signing/lane": {
+    put: {
+      tags: ["Git identity"],
+      summary:
+        "Sign ONE workspace's commits with one of the account's keys (`key`: its id), or stop (`key: null`)",
+      description:
+        "Writes a small file of AgentHub's (`lane-<id>.gitconfig`: gpg.format ssh, user.signingkey, commit.gpgsign) and includes it from the account's `~/.gitconfig` with `includeIf \"gitdir:<the workspace's git dir>\"` and `gitdir:<common dir>/worktrees/ah-<id>-*` (its sessions' worktrees) — nothing is written into the repository. The workspace must be one the caller may see whose folder runs as this same account. `GET /api/me/git` answers `laneSigning: [{laneId, key}]`; deleting a key stops every workspace that signs with it.",
+      operationId: "setLaneCommitSigning",
+      requestBody: json({ laneId: { type: "integer" }, key: { type: "string", nullable: true } }, [
+        "laneId",
+      ]),
+      responses: {
+        200: { description: "The identity, with `laneSigning`." },
+        400: { description: "ENOKEY" },
+        403: { description: "EFOREIGN — the workspace runs as another account; EHOSTIDENTITY." },
+        404: { description: "ENOTFOUND — no such workspace (or not the caller's)." },
+        409: { description: "ENOREPO — the workspace's folder is not a git repository." },
+      },
+    },
+  },
   "/api/me/git/ssh-terminal": {
     put: {
       tags: ["Git identity"],

server/openapi-extra/override-sessions-agents.js

@@ -154,6 +154,14 @@ const paths = {
             "`1` = only sessions blocked on the user (`awaiting_input_since IS NOT NULL AND status = 'active'`), the UI's Waiting filter. Applied before `limit`/`offset`, so `total` stays exact.",
           example: "1",
         },
+        {
+          name: "mine",
+          in: "query",
+          schema: { type: "string", enum: ["1"] },
+          description:
+            "Server mode: `1` = only the caller's OWN sessions, even for an admin or analyst (the pet's count). No-op in local mode.",
+          example: "1",
+        },
         {
           name: "from",
           in: "query",

server/routes/ai-tools.js

@@ -66,6 +66,35 @@ router.put("/omp-sharing", sameOriginGuard, async (req, res) => {
   res.json(state);
 });
 
+// What members' Claude may run on this box (server/lib/member-policy.js,
+// read by scripts/member-guard.js): S3 only, an admin's switch.
+router.get("/member-policy", (_req, res) => {
+  res.json(require("../lib/member-policy").state());
+});
+
+router.put("/member-policy", sameOriginGuard, (req, res) => {
+  const on = req.body?.allowTests;
+  if (typeof on !== "boolean") {
+    return res.status(400).json({ error: { code: "EBADFIELD", message: "allowTests: boolean" } });
+  }
+  const policy = require("../lib/member-policy");
+  if (!policy.available()) {
+    return res.status(409).json({
+      error: { code: "ENOS3", message: "this needs server mode with per-user accounts" },
+    });
+  }
+  const state = policy.setAllowTests(on);
+  if (req.user) {
+    require("../lib/audit").recordAccountChange(
+      req.user.id,
+      null,
+      "PUT",
+      `members' test runs ${on ? "allowed" : "blocked"}`
+    );
+  }
+  res.json(state);
+});
+
 router.put("/:id", sameOriginGuard, (req, res) => {
   const { enabled, default: makeDefault, defaultModel } = req.body || {};
   // Every field checked before anything is written: a bad one saves nothing.

server/routes/git-identity.js

@@ -9,7 +9,15 @@
  * SSH key ID — each optionally tied to one key), and the commit author (`user.name` /
  * `user.email` of the account's global git config — a member's commits fail
  * without one; a new SSH key is labelled with that email, else
- * `<username>@smartgift.vn`). The account is the signed-in user's
+ * `<username>@smartgift.vn`), a key the user already has imported as a
+ * named one (`POST /ssh-key/import` — the private text goes in, only its
+ * public half ever comes back), and whether commits are signed with one of
+ * the keys (`PUT /signing`: `gpg.format ssh` + `user.signingkey` +
+ * `commit.gpgsign` in the account's `~/.gitconfig`; a signing key the user
+ * set themselves is replaced only on `replace: true`, or taken out on
+ * `clearForeign: true` — their key file is never touched), or — per workspace —
+ * which of the caller's workspaces sign (`PUT /signing/lane`, an
+ * `includeIf "gitdir:…"` of one small file of ours each). The account is the signed-in user's
  * own Linux account under S3, else the host's, which only an admin (or local
  * mode) may change (`EHOSTIDENTITY`). Nothing here takes a path from the
  * request, and every write passes the same-origin guard.
@@ -39,6 +47,12 @@ const STATUS = {
   ETOOMANYKEYS: 409,
   EBADALIAS: 400,
   ENOKEY: 400,
+  EBADKEY: 400,
+  EKEYPASSPHRASE: 400,
+  EFOREIGNSIGN: 409,
+  ENOREPO: 409,
+  ENOTFOUND: 404,
+  EFOREIGN: 403,
 };
 
 function fail(res, e) {
@@ -61,6 +75,9 @@ async function view(account, username) {
     // The regions a CodeCommit key ID saved for "every region" covers.
     codecommitRegions: identity.CODECOMMIT_REGIONS,
     https: identity.listHttps(account),
+    signing: await identity.signingState(account),
+    // Workspaces whose commits are signed: `[{laneId, key}]`.
+    laneSigning: await identity.laneSigningList(account),
     author: await identity.getAuthor(account),
     // What the author email form suggests while none is set.
     defaultEmail: identity.defaultEmail(username),
@@ -106,6 +123,87 @@ router.post("/ssh-key", sameOriginGuard, async (req, res) => {
   }
 });
 
+/**
+ * Import a private key the user already has: `{privateKey, name?, sign?,
+ * replace?}`. With `sign`, commits are signed with it at once (one step for
+ * the user); `replace` lets that take over a signing key they set themselves.
+ */
+router.post("/ssh-key/import", sameOriginGuard, async (req, res) => {
+  try {
+    const account = accountOf(req, { write: true });
+    const key = await identity.importSshKey(account, {
+      privateKey: req.body?.privateKey,
+      name: typeof req.body?.name === "string" ? req.body.name : null,
+      comment: (await identity.getAuthor(account)).email || identity.defaultEmail(usernameOf(req)),
+    });
+    let signError = null;
+    if (req.body?.sign === true && key) {
+      // The key is saved either way; a refused switch is said, not thrown away.
+      await identity
+        .setSigning(account, { id: key.id, replace: req.body?.replace === true })
+        .catch((e) => {
+          signError = { code: e.code || "EINTERNAL", message: e.message };
+        });
+    }
+    res.status(201).json({ ...(await view(account, usernameOf(req))), imported: key, signError });
+  } catch (e) {
+    fail(res, e);
+  }
+});
+
+/** Sign commits with key `{key: id}`, or stop (`{key: null}`); `replace` as above. */
+router.put("/signing", sameOriginGuard, async (req, res) => {
+  try {
+    const account = accountOf(req, { write: true });
+    const id = typeof req.body?.key === "string" && req.body.key ? req.body.key : null;
+    await identity.setSigning(account, {
+      id,
+      replace: req.body?.replace === true,
+      clearForeign: req.body?.clearForeign === true,
+    });
+    res.json(await view(account, usernameOf(req)));
+  } catch (e) {
+    fail(res, e);
+  }
+});
+
+/**
+ * Sign the commits of ONE workspace with `{laneId, key}` (`key: null` stops).
+ * The workspace must be one the caller may see (scopeGuard, `laneId` in the
+ * body) whose folder runs as this same account — a workspace another account
+ * runs could never read this account's `~/.gitconfig` (EFOREIGN).
+ */
+router.put("/signing/lane", sameOriginGuard, async (req, res) => {
+  try {
+    const account = accountOf(req, { write: true });
+    const laneId = Number(req.body?.laneId);
+    const id = typeof req.body?.key === "string" && req.body.key ? req.body.key : null;
+    // Stopping touches only this account's own file, so it needs no workspace:
+    // one removed from the dashboard while it signed can still be turned off.
+    if (id == null && Number.isSafeInteger(laneId) && laneId > 0) {
+      await identity.setLaneSigning(account, { laneId, id: null });
+      return res.json(await view(account, usernameOf(req)));
+    }
+    const lane = Number.isSafeInteger(laneId) ? require("../lib/lanes").getLane(laneId) : null;
+    if (!lane || !require("../lib/scope").canSeeLane(req, laneId)) {
+      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no such workspace" } });
+    }
+    const folder = identity.accountForDir(lane.cwd);
+    if (
+      folder.kind !== account.kind ||
+      (folder.kind === "member" && folder.acct.login !== account.acct.login)
+    ) {
+      throw Object.assign(new Error("this workspace runs as another account"), {
+        code: "EFOREIGN",
+      });
+    }
+    await identity.setLaneSigning(account, { laneId, cwd: lane.cwd, id });
+    res.json(await view(account, usernameOf(req)));
+  } catch (e) {
+    fail(res, e);
+  }
+});
+
 router.delete("/ssh-key", sameOriginGuard, async (req, res) => {
   try {
     const account = accountOf(req, { write: true });

server/routes/homes.js

@@ -8,6 +8,7 @@
  *   GET  /api/homes/:who/fs/list|trash|zip|download
  *   POST /api/homes/:who/fs/mkdir|newfile|rename|move|copy|delete|upload|trash/restore|trash/purge
  *   POST /api/homes/:who/fs/upload-batch|upload-check   many small files in one request
+ *   GET|POST|DELETE /api/homes/:who/fs/upload-part     a resumable upload's parts (then `?staged=`)
  *
  * `:who` is `me`, or — for an admin — another user's name: read-only
  * (`403 EREADONLY` on every write) and written to the audit log. The one
@@ -24,6 +25,7 @@ const express = require("express");
 const path = require("node:path");
 
 const fx = require("../lib/file-explorer");
+const staging = require("../lib/upload-staging");
 const homes = require("../lib/homes");
 const scope = require("../lib/scope");
 const lanesLib = require("../lib/lanes");
@@ -46,12 +48,17 @@ function fail(res, err) {
       EUPGRADE: 409,
       EMEMBERGONE: 409,
       ETOOBIG: 413,
+      EOFFSET: 409,
+      EBUSY: 409,
+      EINCOMPLETE: 409,
+      ETOOMANY: 429,
     }[err.code] ?? 500;
   res.status(status).json({
     error: {
       code: err.code || "EFS",
       message: err.message,
       ...(Array.isArray(err.names) ? { names: err.names } : {}),
+      ...(Number.isInteger(err.received) ? { received: err.received } : {}),
     },
   });
 }
@@ -294,22 +301,57 @@ router.post(
     TRASH_W
   )
 );
+/**
+ * The body of an upload: the request, or with `?staged=<id>` the bytes sent
+ * before in parts (`upload-staging.js`; see the workspace routes).
+ */
+function stagedOr(req, write) {
+  if (req.query.staged === undefined) return write(req, req.headers["content-length"]);
+  req.resume();
+  return staging.commit(userKey(req), req.query.staged, write);
+}
+router.get(
+  "/:who/fs/upload-part",
+  handle(async (req, res) => res.json(staging.status(userKey(req), req.query.upload)), W)
+);
+router.post(
+  "/:who/fs/upload-part",
+  sameOriginGuard,
+  handle(async (req, res) => {
+    try {
+      res.json(
+        await staging.putPart(userKey(req), req.query.upload, {
+          offset: req.query.offset,
+          total: req.query.total,
+          stream: req,
+        })
+      );
+    } catch (err) {
+      req.resume();
+      throw err;
+    }
+  }, W)
+);
+router.delete(
+  "/:who/fs/upload-part",
+  sameOriginGuard,
+  handle(async (req, res) => res.json(staging.drop(userKey(req), req.query.upload)), W)
+);
 router.post(
   "/:who/fs/upload",
   sameOriginGuard,
   handle(async (req, res, home) => {
     try {
-      const out = await fx.upload(
-        home.dir,
-        typeof req.query.path === "string" ? req.query.path : "",
-        req,
-        {
-          conflict: req.query.conflict,
-          length: req.headers["content-length"],
-          trash: trashFor(req, home),
-        }
-      );
-      res.status(out.skipped ? 200 : 201).json(out);
+      const r = await stagedOr(req, async (stream, length) => {
+        const out = await fx.upload(
+          home.dir,
+          typeof req.query.path === "string" ? req.query.path : "",
+          stream,
+          { conflict: req.query.conflict, length, trash: trashFor(req, home) }
+        );
+        return { status: out.skipped ? 200 : 201, body: out };
+      });
+      res.status(r.status).json(r.body);
     } catch (err) {
       req.resume();
       throw err;
@@ -321,13 +363,16 @@ router.post(
   sameOriginGuard,
   handle(async (req, res, home) => {
     try {
-      const out = await fx.uploadBatch(
-        home.dir,
-        typeof req.query.dir === "string" ? req.query.dir : "",
-        req,
-        { conflict: req.query.conflict, trash: trashFor(req, home) }
-      );
-      res.status(201).json(out);
+      const r = await stagedOr(req, async (stream) => ({
+        status: 201,
+        body: await fx.uploadBatch(
+          home.dir,
+          typeof req.query.dir === "string" ? req.query.dir : "",
+          stream,
+          { conflict: req.query.conflict, trash: trashFor(req, home) }
+        ),
+      }));
+      res.status(r.status).json(r.body);
     } catch (err) {
       req.resume();
       throw err;

server/routes/hooks.js

@@ -294,6 +294,10 @@ const apiErrorSummariesStmt = db.prepare(
 const turnDurationStampsStmt = db.prepare(
   "SELECT created_at FROM events WHERE session_id = ? AND event_type = 'TurnDuration'"
 );
+// When the session's current turn began: the newest UserPromptSubmit.
+const lastPromptAtStmt = db.prepare(
+  "SELECT MAX(created_at) AS at FROM events WHERE session_id = ? AND event_type = 'UserPromptSubmit'"
+);
 
 // What this process already handled of each session's transcript parse.
 // `transcriptCache.extract` returns the SAME result object while the file is
@@ -1202,6 +1206,7 @@ const processEventTx = db.transaction((hookType, data, tool = "claude", peer = n
         ? null
         : tailAfter(result.turnDurations, mark?.lastTurn, (a, b) => a === b);
       if (freshTurns && freshTurns.length) {
+        endTurnFromTranscript(sessionId, mainAgentId, hookType, freshTurns);
         // `turnDurations` is every turn in the transcript (up to 1000), on
         // every hook: dedupe against ONE read of the recorded timestamps (a
         // covering-index scan) instead of a query per turn — 23 ms per hook on
@@ -1327,6 +1332,33 @@ const processEventTx = db.transaction((hookType, data, tool = "claude", peer = n
  * that transaction COMMITTED — in order, in the same tick. A frame sent from
  * inside it described a row a later throw could still roll back.
  */
+/**
+ * A turn the transcript says has ended is over, Stop hook or not. Claude Code
+ * writes a `turn_duration` entry when a turn finishes, but in roughly one turn
+ * in fifteen it never sends the Stop hook (seen on 2.1.31x: only the
+ * prompt-suggestion helper's SubagentStop arrives), and the main agent then
+ * stayed `working` until the idle Notification a minute later — the chat
+ * showed Stop on a finished answer. So a turn end NEWER than the session's
+ * last prompt, read while the main agent is still working with no tool open,
+ * lands it in Waiting exactly like Stop does. A UserPromptSubmit/PreToolUse is
+ * new work and never ends a turn: its own read may still carry the previous
+ * turn's entry.
+ */
+function endTurnFromTranscript(sessionId, mainAgentId, hookType, turns) {
+  if (!mainAgentId || hookType === "UserPromptSubmit" || hookType === "PreToolUse") return;
+  const main = stmts.getAgent.get(mainAgentId);
+  if (!main || main.status !== "working" || main.current_tool) return;
+  const prompt = lastPromptAtStmt.get(sessionId)?.at;
+  const end = turns.reduce((m, td) => (td.timestamp && td.timestamp > m ? td.timestamp : m), "");
+  if (!end || (prompt && end <= prompt)) return;
+  const now = new Date().toISOString();
+  stmts.updateAgent.run(null, "waiting", null, null, null, null, mainAgentId);
+  stmts.setSessionAwaitingInput.run(now, "stop", sessionId);
+  stmts.setAgentAwaitingInput.run(now, "stop", mainAgentId);
+  broadcast("session_updated", stmts.getSession.get(sessionId));
+  broadcast("agent_updated", stmts.getAgent.get(mainAgentId));
+}
+
 function processEvent(hookType, data, tool, peer = null) {
   const outer = pendingMarks;
   pendingMarks = [];

server/routes/lanes.js

@@ -436,6 +436,23 @@ function refuseFolder(res) {
   });
 }
 
+/**
+ * A member's folder for a workspace no caller picked a directory for (the
+ * pet chat): `<own folder>/sagi`, made AS the member under S3 (`mkdirAs`,
+ * never a host write in their home). The caller still runs it through
+ * `folderAllowed`, so a link planted there cannot lead outside.
+ */
+function ownDefaultFolder(own) {
+  const target = path.join(own, "sagi");
+  if (!fs.existsSync(target)) {
+    const runAs = require("../lib/run-as");
+    const acct = runAs.accountForPath(target);
+    if (acct) runAs.mkdirAs(acct, target);
+    else fs.mkdirSync(target, { recursive: true });
+  }
+  return target;
+}
+
 /**
  * Idempotent "which lane owns this directory?" — the Workspace page opens on a
  * cwd, not on a lane id, so it needs one lane to exist for that cwd without
@@ -447,10 +464,24 @@ router.post("/ensure", sameOriginGuard, (req, res) => {
   // specific directory (e.g. Sagi's mascot companion) get a real, existing
   // path and lane uniqueness stays meaningful. Callers that do care pass one
   // through unchanged.
+  // A member's default is NOT the host's home (outside their folder: EFOLDER,
+  // the pet chat could never start) nor their own home (no workspace under
+  // S3), but `<their folder>/sagi`, made as them on first use.
   // Canonical before the lookup, so the lookup and createLane's insert agree.
-  const cwd = lanesLib.canonicalCwd(
-    typeof body.cwd === "string" && body.cwd.trim() ? body.cwd.trim() : os.homedir()
-  );
+  let cwd;
+  if (typeof body.cwd === "string" && body.cwd.trim()) {
+    cwd = lanesLib.canonicalCwd(body.cwd.trim());
+  } else if (scope.ownFolder(req)) {
+    try {
+      cwd = lanesLib.canonicalCwd(ownDefaultFolder(scope.ownFolder(req)));
+    } catch (err) {
+      return res.status(err.code === "EMEMBERGONE" ? 409 : 500).json({
+        error: { code: err.code || "EMKDIR", message: err.message },
+      });
+    }
+  } else {
+    cwd = lanesLib.canonicalCwd(os.homedir());
+  }
 
   if (body.tool !== undefined && !aiTools.has(body.tool)) {
     return res.status(400).json({ error: { code: "EBADTOOL", message: "unknown tool" } });
@@ -1879,6 +1910,7 @@ router.post("/:id/git/upload", sameOriginGuard, uploadBody, async (req, res) =>
 // folder's account. `conflict` (fail|skip|keep|replace) settles a taken
 // name; 409 EEXISTS carries `names` so the browser can ask.
 const fileExplorer = require("../lib/file-explorer");
+const uploadStaging = require("../lib/upload-staging");
 
 function fsFail(res, err) {
   const status =
@@ -1894,12 +1926,17 @@ function fsFail(res, err) {
       EMEMBERGONE: 409,
       ETOOBIG: 413,
       ENOHOME: 404,
+      EOFFSET: 409,
+      EBUSY: 409,
+      EINCOMPLETE: 409,
+      ETOOMANY: 429,
     }[err.code] ?? 500;
   res.status(status).json({
     error: {
       code: err.code || "EFS",
       message: err.message,
       ...(Array.isArray(err.names) ? { names: err.names } : {}),
+      ...(Number.isInteger(err.received) ? { received: err.received } : {}),
     },
   });
 }
@@ -2056,6 +2093,61 @@ router.post("/:id/fs/trash/purge", sameOriginGuard, async (req, res) => {
   }
 });
 
+/**
+ * An upload's body: the request itself, or — with `?staged=<id>` — the bytes
+ * this user already sent in parts (`upload-staging.js`), so a restart in the
+ * middle costs only the part in flight. `write(stream, length)` answers
+ * `{status, body}`; a staged commit made before answers its stored answer.
+ */
+function stagedOr(req, write) {
+  const id = req.query.staged;
+  if (id === undefined) {
+    return write(req, req.headers["content-length"]);
+  }
+  req.resume();
+  return uploadStaging.commit(fsUserKey(req), id, write);
+}
+
+/**
+ * One part of a resumable upload (`?upload=&offset=&total=`, raw bytes); GET = how
+ * much arrived (`{received, total, done}`), DELETE = forget it. The bytes stay
+ * on the host until `/fs/upload` or `/fs/upload-batch` names `?staged=<id>`.
+ */
+router.get("/:id/fs/upload-part", async (req, res) => {
+  const t = await gitTargetOr404(req, res);
+  if (!t) return;
+  try {
+    res.json(uploadStaging.status(fsUserKey(req), req.query.upload));
+  } catch (err) {
+    fsFail(res, err);
+  }
+});
+router.post("/:id/fs/upload-part", sameOriginGuard, async (req, res) => {
+  const t = await gitTargetOr404(req, res);
+  if (!t) return;
+  try {
+    res.json(
+      await uploadStaging.putPart(fsUserKey(req), req.query.upload, {
+        offset: req.query.offset,
+        total: req.query.total,
+        stream: req,
+      })
+    );
+  } catch (err) {
+    req.resume();
+    fsFail(res, err);
+  }
+});
+router.delete("/:id/fs/upload-part", sameOriginGuard, async (req, res) => {
+  const t = await gitTargetOr404(req, res);
+  if (!t) return;
+  try {
+    res.json(uploadStaging.drop(fsUserKey(req), req.query.upload));
+  } catch (err) {
+    fsFail(res, err);
+  }
+});
+
 /**
  * Upload one file, streamed (no body parser buffers it), to `?path=` — any
  * missing sub-folders are made (a folder upload sends each file with its
@@ -2065,17 +2157,17 @@ router.post("/:id/fs/upload", sameOriginGuard, async (req, res) => {
   const t = await gitTargetOr404(req, res);
   if (!t) return;
   try {
-    const out = await fileExplorer.upload(
-      t.cwd,
-      typeof req.query.path === "string" ? req.query.path : "",
-      req,
-      {
-        conflict: req.query.conflict,
-        length: req.headers["content-length"],
-        trash: fsTrashFor(req, t),
-      }
-    );
-    res.status(out.skipped ? 200 : 201).json(out);
+    const write = async (stream, length) => {
+      const out = await fileExplorer.upload(
+        t.cwd,
+        typeof req.query.path === "string" ? req.query.path : "",
+        stream,
+        { conflict: req.query.conflict, length, trash: fsTrashFor(req, t) }
+      );
+      return { status: out.skipped ? 200 : 201, body: out };
+    };
+    const r = await stagedOr(req, write);
+    res.status(r.status).json(r.body);
   } catch (err) {
     req.resume();
     fsFail(res, err);
@@ -2091,13 +2183,17 @@ router.post("/:id/fs/upload-batch", sameOriginGuard, async (req, res) => {
   const t = await gitTargetOr404(req, res);
   if (!t) return;
   try {
-    const out = await fileExplorer.uploadBatch(
-      t.cwd,
-      typeof req.query.dir === "string" ? req.query.dir : "",
-      req,
-      { conflict: req.query.conflict, trash: fsTrashFor(req, t) }
-    );
-    res.status(201).json(out);
+    const write = async (stream) => ({
+      status: 201,
+      body: await fileExplorer.uploadBatch(
+        t.cwd,
+        typeof req.query.dir === "string" ? req.query.dir : "",
+        stream,
+        { conflict: req.query.conflict, trash: fsTrashFor(req, t) }
+      ),
+    });
+    const r = await stagedOr(req, write);
+    res.status(r.status).json(r.body);
   } catch (err) {
     req.resume();
     fsFail(res, err);
@@ -3468,11 +3564,12 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
     // cannot do (EUNSUPPORTED: a fork on a non-Claude lane) is the request's fault.
     // ENOTSHARED (S3): the tool is not under /opt/agenthub/tools yet — a setup state.
     // EQUOTA (server mode): the workspace owner is over their spend quota.
+    // ESESSIONLIMIT (S3): the member already runs the most AI sessions allowed.
     const status = /^(EBAD|EUNSUPPORTED$)/.test(err.code || "")
       ? 400
       : ["ENOTSHARED", "EMEMBERGONE", "EOWNERFOLDER", "ECWDACCOUNT"].includes(err.code)
         ? 409
-        : err.code === "EQUOTA"
+        : err.code === "EQUOTA" || err.code === "ESESSIONLIMIT"
           ? 429
           : 500;
     return res.status(status).json({ error: { code: err.code, message: err.message } });