feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/lib/git-exclude.js

@@ -8,7 +8,6 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 
@@ -36,23 +35,37 @@ const REPO_VARS = [
  * @param {string[]} relPaths e.g. [".mcp.json", ".claude/.cc-config-backups/"]
  */
 function excludeFromGit(laneDir, relPaths) {
+  const runAs = require("./run-as");
   try {
     const env = { ...process.env };
     for (const name of REPO_VARS) delete env[name];
-    const [commonDir, prefix = ""] = execFileSync(
-      "git",
-      ["rev-parse", "--git-common-dir", "--show-prefix"],
-      { cwd: laneDir, env, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    // As the folder's member under S3 (git refuses another uid's repository).
+    const [commonDir, prefix = ""] = String(
+      runAs.execIn(laneDir, "git", ["rev-parse", "--git-common-dir", "--show-prefix"], {
+        env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      })
     ).split("\n");
+    // Under S3 the member's git printed this path (a `.git` file or a
+    // `commondir` can name any directory): it must resolve inside the lane
+    // owner's own files, or the dashboard would read and write wherever the
+    // member pointed it — as the host, outside the users root.
+    const common = fs.realpathSync(path.resolve(laneDir, commonDir));
+    if (!runAs.sameOwner(path.resolve(laneDir), common)) return;
     const lines = relPaths.map((rel) => `/${prefix}${rel}`);
-    const excludePath = path.join(path.resolve(laneDir, commonDir), "info", "exclude");
-    fs.mkdirSync(path.dirname(excludePath), { recursive: true });
-    let existing = fs.existsSync(excludePath) ? fs.readFileSync(excludePath, "utf8") : "";
+    const excludePath = path.join(common, "info", "exclude");
+    // readFileSafe: a member's FIFO or link to another account's file is refused.
+    let existing = fs.existsSync(excludePath) ? runAs.readFileSafe(excludePath, "utf8") : "";
     const present = new Set(existing.split("\n"));
     const missing = lines.filter((line) => !present.has(line));
     if (missing.length === 0) return;
     if (existing && !existing.endsWith("\n")) existing += "\n";
-    fs.writeFileSync(excludePath, `${existing}${missing.join("\n")}\n`);
+    // `info/` exists in every repo git made; under S3 only its member may write it.
+    if (!runAs.accountForPath(excludePath)) {
+      fs.mkdirSync(path.dirname(excludePath), { recursive: true });
+    }
+    runAs.writeFileAs(excludePath, `${existing}${missing.join("\n")}\n`);
   } catch {
     /* not a repo, or unwritable — see above */
   }
@@ -61,19 +74,24 @@ function excludeFromGit(laneDir, relPaths) {
 /**
  * The same, anchored at the REPOSITORY root rather than `dir` — for paths a
  * tool creates at the root whatever subdirectory it was started in (Claude
- * Code's `.claude/worktrees/`). Best effort, like `excludeFromGit`.
+ * Code's `.claude/worktrees/`). Best effort, like `excludeFromGit`. The root
+ * the (member's) git names must be the same account's as `dir`.
  */
 function excludeFromRepoRoot(dir, relPaths) {
+  const runAs = require("./run-as");
   try {
     const env = { ...process.env };
     for (const name of REPO_VARS) delete env[name];
-    const root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: dir,
-      env,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-    if (root) excludeFromGit(root, relPaths);
+    const root = String(
+      runAs.execIn(dir, "git", ["rev-parse", "--show-toplevel"], {
+        env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      })
+    ).trim();
+    if (!root) return;
+    const real = fs.realpathSync(root);
+    if (runAs.sameOwner(path.resolve(dir), real)) excludeFromGit(real, relPaths);
   } catch {
     /* not a repo */
   }