feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/lib/git-ops.js

@@ -50,7 +50,6 @@
  */
 
 const fs = require("node:fs");
-const os = require("node:os");
 const path = require("node:path");
 const {
   git: rawGit,
@@ -384,7 +383,10 @@ async function runGitAction(dir, action, body = {}) {
     // are still in it (the same check `resolve` makes).
     for (const p of paths.filter((p) => CONFLICT_CODES.has(p.code))) {
       const file = path.join(dir, p.path);
-      if (fs.existsSync(file) && MARKER_RE.test(await fs.promises.readFile(file, "utf8"))) {
+      if (
+        fs.existsSync(file) &&
+        MARKER_RE.test(await require("./run-as").readFileSafeAsync(file, "utf8"))
+      ) {
         throw bad("EMARKERS", `${p.path} still has conflict markers`);
       }
     }
@@ -455,20 +457,14 @@ async function runGitAction(dir, action, body = {}) {
     if (!patch) throw bad("EHUNKGONE", "that change is no longer in the diff; refresh and retry");
     // The patch names paths from the repo root, so it is applied there.
     const top = (await git(dir, ["rev-parse", "--show-toplevel"])).stdout.trim();
-    const tmp = await fs.promises.mkdtemp(path.join(os.tmpdir(), "agenthub-hunk-"));
-    const file = path.join(tmp, "hunk.patch");
-    try {
-      await fs.promises.writeFile(file, patch);
-      const zero = Number(body.context) === 0 ? ["--unidiff-zero"] : [];
-      // stage: HEAD -> worktree hunk onto the index; undo: the same hunk,
-      // reversed, off the working tree. A hunk the index or tree no longer
-      // matches fails in git's own words (409), never half-applies.
-      const args =
-        action === "stage-hunk" ? ["apply", "--cached", ...zero] : ["apply", "-R", ...zero];
-      return done(action, await git(top, [...args, file]));
-    } finally {
-      await fs.promises.rm(tmp, { recursive: true, force: true });
-    }
+    const zero = Number(body.context) === 0 ? ["--unidiff-zero"] : [];
+    // stage: HEAD -> worktree hunk onto the index; undo: the same hunk,
+    // reversed, off the working tree. A hunk the index or tree no longer
+    // matches fails in git's own words (409), never half-applies. The patch
+    // goes in on stdin — no file to write (S3: never one in a member's home).
+    const args =
+      action === "stage-hunk" ? ["apply", "--cached", ...zero] : ["apply", "-R", ...zero];
+    return done(action, await git(top, [...args, "-"], { input: patch }));
   }
 
   if (action === "commit") {
@@ -572,7 +568,7 @@ async function mergeAction(dir, action, body) {
       return done(action, await git(dir, ["add", "--", p]));
     }
     if (side === "done" && fs.existsSync(path.join(dir, p))) {
-      if (MARKER_RE.test(await fs.promises.readFile(path.join(dir, p), "utf8"))) {
+      if (MARKER_RE.test(await require("./run-as").readFileSafeAsync(path.join(dir, p), "utf8"))) {
         throw bad("EMARKERS", `${p} still has conflict markers`);
       }
       return done(action, await git(dir, ["add", "--", p]));
@@ -833,22 +829,22 @@ async function commitSelection(dir, args, body) {
     p.from && p.code.includes("R") ? [p.path, p.from] : [p.path]
   );
   const top = (await git(dir, ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const tmp = await fs.promises.mkdtemp(path.join(os.tmpdir(), "agenthub-commit-"));
-  const env = { GIT_INDEX_FILE: path.join(tmp, "index") };
+  // A temporary index git itself creates (S3: as the member, in their own
+  // handoff dir — the dashboard never writes there).
+  const scratch = require("./run-as").scratchFile(top, "agenthub-index-");
+  const env = { GIT_INDEX_FILE: scratch.file };
   try {
     await git(dir, (await hasHead(dir)) ? ["read-tree", "HEAD"] : ["read-tree", "--empty"], {
       env,
     });
     if (wholePaths.length) await git(dir, ["add", "-A", "--", ...wholePaths], { env });
-    const file = path.join(tmp, "part.patch");
     const zero = Number(body.context) === 0 ? ["--unidiff-zero"] : [];
     for (const [p, list] of picks) {
       const patch = await selectionPatch(dir, p, body.context, list);
       if (!patch)
         throw bad("EHUNKGONE", `${p}: that change is no longer in the diff; refresh and retry`);
-      await fs.promises.writeFile(file, patch);
       // The patch names paths from the repo root, so it is applied there.
-      await git(top, ["apply", "--cached", ...zero, file], { env });
+      await git(top, ["apply", "--cached", ...zero, "-"], { env, input: patch });
     }
     const out = await git(dir, ["commit", ...args], { env });
     await git(dir, ["reset", "-q", "--", ...wholePaths, ...part.map((p) => p.path)]).catch(
@@ -856,7 +852,7 @@ async function commitSelection(dir, args, body) {
     );
     return out;
   } finally {
-    await fs.promises.rm(tmp, { recursive: true, force: true });
+    scratch.remove();
   }
 }
 
@@ -882,12 +878,13 @@ async function ignorePaths(dir, body) {
   const file = path.join(dir, ".gitignore");
   const st = await fs.promises.lstat(file).catch(() => null);
   if (st && !st.isFile()) throw bad("EBADPATH", ".gitignore is not a regular file");
-  const old = st ? await fs.promises.readFile(file, "utf8") : "";
+  const old = st ? await require("./run-as").readFileSafeAsync(file, "utf8") : "";
   const have = new Set(old.split(/\r?\n/));
   const lines = [...new Set(paths.map((p) => ignoreLine(p.path)))].filter((l) => !have.has(l));
   if (lines.length) {
     const sep = old && !old.endsWith("\n") ? "\n" : "";
-    await fs.promises.appendFile(file, `${sep}${lines.join("\n")}\n`);
+    // As the folder's member under S3 (the dashboard cannot write there).
+    require("./run-as").writeFileAs(file, `${sep}${lines.join("\n")}\n`, { append: true });
   }
   return done("ignore", { stdout: lines.map((l) => `${l}\n`).join(""), stderr: "" });
 }