feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/components/run/PaneChat.tsx

@@ -65,6 +65,7 @@ export function PaneChat({
             rows={2}
             slash={tool === "claude"}
             fileCwd={cwd}
+            lane={runId}
           />
           <div className="mt-1 flex items-center gap-2">
             <span className="text-[11px] text-fg-muted">{t("chat.hint")}</span>

client/src/components/run/RunSetup.tsx

@@ -163,6 +163,8 @@ interface PromptEditorProps {
   /** An image upload started (true) or settled (false): the caller holds its
    *  send button meanwhile, or the prompt would go out without the image. */
   onBusyChange?: (busy: boolean) => void;
+  /** The workspace (id, or a pane's run id) whose panes read the files. */
+  lane?: number | string;
 }
 
 /** An attached file: its path on the server's machine, and a local preview
@@ -187,6 +189,7 @@ export function PromptEditor({
   onImagesChange,
   bare,
   onBusyChange,
+  lane,
 }: PromptEditorProps) {
   const { t } = useTranslation("run");
   const taRef = useRef<HTMLTextAreaElement | null>(null);
@@ -325,7 +328,7 @@ export function PromptEditor({
     const picked = Array.from(list ?? []);
     if (picked.length === 0) return false;
     setUpload("uploading");
-    Promise.all(picked.map((f) => api.run.dropFile(f)))
+    Promise.all(picked.map((f) => api.run.dropFile(f, lane)))
       .then((saved) => {
         setUpload(null);
         const added = picked.map((f, i) => ({

client/src/components/run/TerminalView.tsx

@@ -192,7 +192,7 @@ export function TerminalView({ runId, wsBaseUrl, onExit, autoFocus = true }: Ter
     if (files.length === 0) return;
     setDrop("uploading");
     try {
-      const saved = await Promise.all(files.map((f) => api.run.dropFile(f)));
+      const saved = await Promise.all(files.map((f) => api.run.dropFile(f, runId)));
       // paste(), not a raw send: it honours bracketed-paste mode, so claude
       // sees pasted paths rather than typed keystrokes.
       termRef.current?.paste(saved.map((r) => r.path).join(" ") + " ");

client/src/components/run/__tests__/RunSetup.test.tsx

@@ -186,6 +186,7 @@ describe("PromptEditor — newlines and images", () => {
             fileCwd="/Users/tester"
             images={images}
             onImagesChange={setImages}
+            lane={7}
           />
           <output data-testid="sent">{promptWithImages("see", images)}</output>
         </>
@@ -195,7 +196,8 @@ describe("PromptEditor — newlines and images", () => {
     const img = new File(["x"], "shot.png", { type: "image/png" });
     fireEvent.paste(box(), { clipboardData: { files: [img] } });
     const thumb = await screen.findByRole("button", { name: "shot.png" });
-    expect(api.run.dropFile).toHaveBeenCalledWith(img);
+    // Saved where workspace 7's panes can read it.
+    expect(api.run.dropFile).toHaveBeenCalledWith(img, 7);
     // The path is not typed into the prompt; it goes with it on send.
     expect(screen.getByTestId("sent").textContent).toBe("see /tmp/agenthub-drops-1/a.png");
 

client/src/components/run/__tests__/TerminalView.test.tsx

@@ -23,7 +23,7 @@ const focusMock = vi.fn();
 const pasteMock = vi.fn();
 const dropFileMock = vi.fn();
 vi.mock("../../../lib/api", () => ({
-  api: { run: { dropFile: (f: File) => dropFileMock(f) } },
+  api: { run: { dropFile: (f: File, lane?: string) => dropFileMock(f, lane) } },
 }));
 const loadAddonMock = vi.fn();
 // Mutable stand-ins for the two live terminal facts the wheel handler reads.
@@ -481,7 +481,8 @@ describe("TerminalView", () => {
     await waitFor(() =>
       expect(pasteMock).toHaveBeenCalledWith("/tmp/agenthub-drops-1/ab-shot.png ")
     );
-    expect(dropFileMock).toHaveBeenCalledWith(img);
+    // The pane's run id: saved where that pane can read it.
+    expect(dropFileMock).toHaveBeenCalledWith(img, "r1");
     await waitFor(() => expect(screen.queryByTestId("terminal-drop")).toBeNull());
   });