---
name: s3-main-merge-notes
description: "Exact edits to apply when merging s3-next (S3 server mode) into main — agenthub-26's chat/drop/permission-mode work on main needs S3 routing"
metadata:
  node_type: memory
  type: project
  originSessionId: 0b101e16-e1e6-4423-9539-49ddea37ddf0
  modified: 2026-10-09T02:21:46.744Z
---

On 2026-10-09, agenthub-26 left uncommitted work on main. It covers the chat UI, drop images and permission-mode. These files overlap with S3 (see [[agenthub-multi-user-goal]]). When s3-next merges into main, do the following:

1. `server/lib/tmux.js`: `capturePane` and `sendKey` call `execImpl` on main. Change both to member routing:
   - `capturePane = onServerOf(name, ["capture-pane","-p","-t",pane(name)])`
   - `sendKey = onServerOf(name, ["send-keys","-t",pane(name),key])`
   Check that only ONE `function onServerOf` survives the merge. In CommonJS a second declaration silently wins and turns member routing off. `server/lib/pane-mode.js` only goes through those two helpers, so it inherits the routing.
2. `GET /api/run/drop/:name` (`server/routes/run.js`): on main it opens with O_NOFOLLOW|O_NONBLOCK, then fstats the descriptor, and requires `uid === process.getuid()`. The name regex accepts only ids the server made. Under S3:
   - use `dropDir(req)`, the requester's own account;
   - compare `st.uid` to the member's uid, or call run-as `openSafe`.
   Agreed trade-off: an admin viewing a member's session sees the file-name chip, not the image.
3. `GET|POST /api/run/:id/permission-mode` is already covered by `scope.canSeeRun` and the `/run/:id` PATH_RULES. It types only through `tmux.sendKey`, so point 1 covers it.

**Why:** under S3 the host must never use a member's tmux socket or member files directly (P8 F1/F3). A plain merge would silently keep host-side calls.

**How to apply:** do this at the s3-next → main merge. Message agenthub-26 (if it is still alive) before committing on main.