feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/plugin-bootstrap.js

@@ -628,14 +628,31 @@ function pruneRetiredPluginRoots(rt, root = PLUGIN_ROOT) {
   return removed;
 }
 
+/**
+ * Server mode with one Linux user per account (S3): this machine's dashboard
+ * belongs to the host account named in `/etc/agenthub/server.conf`. A member
+ * who installs the plugin in their own `~/.claude` must never bootstrap — it
+ * would start a second dashboard, as them, onto the host's port. Pure fs.
+ */
+function notTheHost() {
+  try {
+    const conf = process.env.AGENTHUB_SERVER_CONF || "/etc/agenthub/server.conf";
+    const m = /^HOST_UID=(\d+)$/m.exec(fs.readFileSync(conf, "utf8"));
+    return Boolean(m) && typeof process.getuid === "function" && process.getuid() !== Number(m[1]);
+  } catch {
+    return false; // no S3 install: every account bootstraps as before
+  }
+}
+
 /**
  * The real work. Runs detached from the SessionStart hook, so its only channel
  * is the log file; `/agenthub-update` runs it in the foreground with `force`, which
  * reinstalls dependencies and restarts the server unconditionally.
  *
- * @returns {"ok"|"locked"|"node-too-old"|"install-failed"|"superseded"}
+ * @returns {"ok"|"locked"|"node-too-old"|"install-failed"|"superseded"|"not-host"}
  */
 function bootstrap(rt = runtimeDir(), { force = false } = {}) {
+  if (notTheHost()) return "not-host";
   fs.mkdirSync(rt, { recursive: true });
 
   // First, and ahead of the lock: a retired build has nothing to do and must
@@ -852,7 +869,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
  * worker so the session never waits on an install.
  */
 function main() {
-  if (fastPathOk()) return;
+  if (notTheHost() || fastPathOk()) return;
   const child = spawn(process.execPath, [__filename, "--worker"], {
     detached: true,
     stdio: "ignore",
@@ -869,6 +886,7 @@ module.exports = {
   LOCK_STALE_MS,
   KEEP_RETIRED_ROOTS,
   supersededBy,
+  notTheHost,
   pruneRetiredPluginRoots,
   installedPluginsPath,
   pluginVersion,