feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/lib/codex-ingest.js

@@ -65,11 +65,17 @@ function allRolloutFiles(home = getCodexHome()) {
   return out;
 }
 
-/** The newest MAX_FILES rollout journals, newest mtime first. */
+/** The newest MAX_FILES rollout journals of each home, newest mtime first. */
 function rolloutFiles() {
-  return allRolloutFiles()
-    .sort((a, b) => b.mtime - a.mtime)
-    .slice(0, MAX_FILES);
+  // This account's CODEX_HOME and every member's (S3) — capped PER home, so
+  // one member touching many journals cannot push everyone else's out.
+  const newest = (files) => files.sort((a, b) => b.mtime - a.mtime).slice(0, MAX_FILES);
+  const members = require("./run-as")
+    .memberHomes()
+    .map((h) => path.join(h, ".codex"));
+  return [allRolloutFiles(), ...members.map((h) => allRolloutFiles(h))]
+    .flatMap(newest)
+    .sort((a, b) => b.mtime - a.mtime);
 }
 
 const cwdCache = new Map(); // rollout path → thread cwd (written once, at thread creation)
@@ -79,7 +85,7 @@ function rolloutCwd(file) {
   if (cwdCache.has(file)) return cwdCache.get(file);
   let cwd = null;
   try {
-    const fd = fs.openSync(file, "r");
+    const fd = require("./run-as").openSafe(file);
     try {
       const buf = Buffer.alloc(64 * 1024);
       const read = fs.readSync(fd, buf, 0, buf.length, 0);
@@ -138,8 +144,11 @@ function ingestCodexOnce({ broadcast } = {}) {
   for (const file of files) {
     const cwd = rolloutCwd(file.path);
     if (!cwd) continue;
+    // A journal speaks only for its own account's lanes (S3): its cwd is what
+    // the journal SAYS, and a member can write any cwd into their own file.
     const lane = codexLanes
       .filter((l) => cwd === l.cwd || cwd.startsWith(`${l.cwd}/`))
+      .filter((l) => require("./run-as").sameOwner(file.path, l.cwd))
       .sort((a, b) => b.cwd.length - a.cwd.length)[0];
     if (!lane) continue;