feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/lib/cursor-usage.js

@@ -39,31 +39,32 @@ function getCursorDir() {
 
 const norm = (s) => s.replace(/[^A-Za-z0-9]/g, "-");
 
+// A walk enters at most this many directories: a member can build a tree (or
+// a symlink loop) whose matching paths grow exponentially with the slug.
+const MAX_VISITS = 500;
+
 /**
  * The existing directory whose path slugs to `slug`, or null. Walks from `/`,
- * trying every entry whose own slug is a prefix of what is left.
+ * trying every real directory (never a symlink) whose own slug is a prefix of
+ * what is left; gives up (null) after MAX_VISITS directories.
  */
 function cwdFromSlug(slug, root = "/") {
+  let visits = 0;
   const walk = (dir, rest, depth) => {
-    if (!rest) {
-      try {
-        return fs.statSync(dir).isDirectory() ? dir : null;
-      } catch {
-        return null;
-      }
-    }
-    if (depth > 40) return null;
-    let names;
+    if (!rest) return dir;
+    if (depth > 40 || ++visits > MAX_VISITS) return null;
+    let entries;
     try {
-      names = fs.readdirSync(dir);
+      entries = fs.readdirSync(dir, { withFileTypes: true });
     } catch {
       return null;
     }
-    for (const name of names) {
-      const n = norm(name);
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      const n = norm(e.name);
       if (rest !== n && !rest.startsWith(`${n}-`)) continue;
-      const hit = walk(path.join(dir, name), rest.slice(n.length + 1), depth + 1);
-      if (hit) return hit;
+      const hit = walk(path.join(dir, e.name), rest.slice(n.length + 1), depth + 1);
+      if (hit || visits > MAX_VISITS) return hit;
     }
     return null;
   };
@@ -75,7 +76,7 @@ function cwdFromSlug(slug, root = "/") {
 function firstPrompt(file) {
   let text;
   try {
-    const fd = fs.openSync(file, "r");
+    const fd = require("./run-as").openSafe(file);
     try {
       const buf = Buffer.alloc(Math.min(fs.fstatSync(fd).size, HEAD_BYTES));
       fs.readSync(fd, buf, 0, buf.length, 0);
@@ -104,9 +105,17 @@ function firstPrompt(file) {
   return null;
 }
 
-/** Every agent transcript, with its project slug, birth and mtime. */
+/** Every agent transcript, with its project slug, birth and mtime — this
+ *  account's, then every member's (S3: their own home). */
 function transcriptFiles() {
-  const projects = path.join(getCursorDir(), "projects");
+  const members = require("./run-as")
+    .memberHomes()
+    .map((h) => path.join(h, ".cursor"));
+  return [getCursorDir(), ...members].flatMap((dir) => transcriptFilesIn(dir));
+}
+
+function transcriptFilesIn(cursorDir) {
+  const projects = path.join(cursorDir, "projects");
   let slugs;
   try {
     slugs = fs.readdirSync(projects);
@@ -164,6 +173,9 @@ const fresh = (mtime, now) => mtime - now < FUTURE_SLACK_MS && now - mtime < ACT
 function writeSession(f, now) {
   const existing = stmts.getSession.get(f.id);
   if (existing && existing.tool !== "cursor") return null;
+  // S3: a member's transcript names only their own folder and session.
+  const cwd = existing?.cwd ? null : cwdFromSlug(f.slug);
+  if (!require("./run-as").sameOwner(f.path, existing?.cwd || cwd)) return null;
   const lastWrite = new Date(f.mtime).toISOString();
   const active = fresh(f.mtime, now);
   const status = active ? "active" : "completed";
@@ -175,7 +187,7 @@ function writeSession(f, now) {
       status,
       endedAt,
       lastWrite,
-      existing.cwd ? null : cwdFromSlug(f.slug),
+      cwd,
       f.id
     );
     return "session_updated";
@@ -184,7 +196,7 @@ function writeSession(f, now) {
     f.id,
     name,
     status,
-    cwdFromSlug(f.slug),
+    cwd,
     new Date(Math.min(f.birth, f.mtime)).toISOString(),
     endedAt,
     lastWrite,