feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes/cc-config.js

@@ -37,12 +37,15 @@ const { broadcast } = require("../websocket");
 const { reloadOpenSessions } = require("../lib/cc-reload");
 const { startUpdateAll, readUpdateAll, isRunning } = require("../lib/cc-update-all");
 const { detectPluginInstall } = require("../lib/update-check");
+const scope = require("../lib/scope");
 
 /** Mirrors cc-plugin-cli's own spec rule — ids from the CLI's JSON still reach
  *  an argv in the detached batch worker, so they are filtered before they go. */
 const PLUGIN_SPEC_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*(@[A-Za-z0-9][A-Za-z0-9._-]*)?$/;
 
 const router = Router();
+// Server mode: a non-admin's ?cwd= only names one of their own workspaces.
+router.use(scope.ownCwdQuery);
 
 function emitChanged(payload) {
   try {
@@ -91,12 +94,34 @@ function cwdOf(req) {
   return c || process.cwd();
 }
 
+/**
+ * `{scope, cwd}` for the two lists a member may read (the run form's `/`
+ * autocomplete). Server mode keeps a member's project items to their own
+ * workspaces: another folder answers 403 EFOLDER, and with no `?cwd=` there is
+ * no project at all (never the dashboard's own working directory). Returns null
+ * once it has answered; `none` = nothing to list.
+ */
+function listOpts(req, res) {
+  const opts = { scope: scopeOf(req), cwd: cwdOf(req) };
+  if (scope.memberId(req) == null) return opts;
+  const asked = typeof req.query.cwd === "string" && req.query.cwd;
+  if (!asked) return opts.scope === "project" ? { none: true } : { ...opts, scope: "user" };
+  if (!path.isAbsolute(asked) || !scope.insideOwnWorkspace(req, path.resolve(asked))) {
+    res.status(403).json({
+      error: { code: "EFOLDER", message: "that folder is not one of your workspaces" },
+    });
+    return null;
+  }
+  return opts;
+}
+
 router.get("/overview", (req, res) => {
   res.json(cc.readOverview({ cwd: cwdOf(req) }));
 });
 
 router.get("/skills", (req, res) => {
-  res.json({ items: cc.readSkills({ scope: scopeOf(req), cwd: cwdOf(req) }) });
+  const opts = listOpts(req, res);
+  if (opts) res.json({ items: opts.none ? [] : cc.readSkills(opts) });
 });
 
 router.get("/agents", (req, res) => {
@@ -104,7 +129,8 @@ router.get("/agents", (req, res) => {
 });
 
 router.get("/commands", (req, res) => {
-  res.json({ items: cc.readCommands({ scope: scopeOf(req), cwd: cwdOf(req) }) });
+  const opts = listOpts(req, res);
+  if (opts) res.json({ items: opts.none ? [] : cc.readCommands(opts) });
 });
 
 router.get("/output-styles", (req, res) => {