feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes/hooks.js

@@ -182,12 +182,18 @@ const LANE_DONE_HOOKS = new Set(["Stop", "SessionEnd"]);
  * running/idle, so without this an adopted lane read "idle" for the entire
  * time Claude was working in it.
  */
-function touchLaneFromHook(hookType, data, tool = "claude", runId = null) {
+function touchLaneFromHook(hookType, data, tool = "claude", runId = null, peer = null) {
   try {
     if (!data || !data.cwd) return;
     // One read of the lane table for every path this hook resolves.
     // ponytail: a scan per hook — fine at dozens of lanes; index by cwd prefix if lane counts grow.
-    const allLanes = lanesLib.listLanes();
+    let allLanes = lanesLib.listLanes();
+    // S3: a member's hook moves only a workspace inside their own home — not
+    // one at an ancestor folder, nor (by a tool's paths) another member's.
+    if (peer?.kind === "member") {
+      const { inside } = require("../lib/hook-auth");
+      allLanes = allLanes.filter((l) => inside(peer.home, l.cwd));
+    }
     // Pin to the lane of the CLI that sent the hook — a Claude hook never
     // touches the codex lane sharing its directory, nor a Codex hook the
     // claude one.
@@ -1311,7 +1317,14 @@ function antigravityHookInput(hookType, data) {
   if (typeof id !== "string" || !/^[0-9a-f-]{36}$/.test(id)) return null;
   if (typeof data.transcriptPath !== "string") return null;
   const transcript = path.resolve(data.transcriptPath);
-  if (!agyCliDirs().some((dir) => transcript.startsWith(dir + path.sep))) return null;
+  // The host's agy, or a member's (S3) — hook-auth then holds a member to their own.
+  const dirs = [
+    ...agyCliDirs(),
+    ...require("../lib/run-as")
+      .memberHomes()
+      .map((h) => path.join(h, ".gemini", "antigravity-cli")),
+  ];
+  if (!dirs.some((dir) => transcript.startsWith(dir + path.sep))) return null;
   const cwd = Array.isArray(data.workspacePaths) ? data.workspacePaths[0] : null;
   const d = {
     session_id: id,
@@ -1410,7 +1423,7 @@ const PUSH_STRIPPED = ["transcript_path", "agent_transcript_path", "transcriptPa
  * stored event and the (mapped) hook when one was stored. A pushed hook never
  * touches a session another source owns, a lane or a dashboard pane.
  */
-function ingestHook(body, pushSource = null) {
+function ingestHook(body, pushSource = null, peer = { kind: "host" }) {
   let { hook_type, data } = body || {};
   if (!hook_type || !data) {
     return {
@@ -1429,6 +1442,7 @@ function ingestHook(body, pushSource = null) {
   const tool = Object.hasOwn(HOOK_TOOLS, body.tool) ? body.tool : "claude";
   if (tool !== "claude") {
     if (!data || typeof data !== "object") return ignored;
+    require("../lib/hook-auth").dropForeignPaths(peer, data);
     const mapped = HOOK_TOOLS[tool](hook_type, data);
     if (!mapped) return ignored;
     ({ hookType: hook_type, data } = mapped);
@@ -1437,6 +1451,19 @@ function ingestHook(body, pushSource = null) {
   // whole, before anything is stored.
   if (isIgnoredCwd(data.cwd)) return ignored;
 
+  // S3: a member's hook (by its connection's uid, lib/hook-auth.js) reports
+  // only their own work — never another account's session, pane or files.
+  const refusal = require("../lib/hook-auth").checkMemberHook(peer, data, body, {
+    getSession: (id) => stmts.getSession.get(id),
+    getRun: (id) => require("../lib/dashboard-runs").getRun(id),
+  });
+  if (refusal) {
+    return {
+      status: refusal.status,
+      body: { error: { code: refusal.code, message: refusal.message } },
+    };
+  }
+
   // A pushed session id is the sender's to choose: it may only extend a
   // session its own source created, never one of this machine's or another's.
   let pushedNew = false;
@@ -1493,7 +1520,7 @@ function ingestHook(body, pushSource = null) {
           broadcast("session_updated", stmts.getSession.get(data.session_id));
         }
       } else {
-        touchLaneFromHook(hook_type, data, tool, body.run_id);
+        touchLaneFromHook(hook_type, data, tool, body.run_id, peer);
         bindRunSession(body.run_id, data.session_id, hook_type, data.source, tool);
       }
     }
@@ -1512,7 +1539,14 @@ function ingestHook(body, pushSource = null) {
 }
 
 router.post("/event", (req, res) => {
-  const out = ingestHook(req.body);
+  // S3: the account behind this loopback connection (lib/hook-auth.js).
+  const peer = require("../lib/hook-auth").hookPeer(req);
+  if (peer.kind === "refused") {
+    return res.status(403).json({
+      error: { code: "EPEER", message: "hooks are accepted from AgentHub's accounts only" },
+    });
+  }
+  const out = ingestHook(req.body, null, peer);
   res.status(out.status).json(out.body);
   if (!out.result) return;
   const { result, hook_type, data, tool } = out;
@@ -2009,6 +2043,20 @@ function livenessReap({ ignoreIdleGate = false, asyncProbe = false, probe = null
   if (!probe) probe = liveness.probeLiveCwds();
   if (!probe.available) return;
   const now = Date.now();
+  // S3: a member's claude runs as another uid, whose cwd this process cannot
+  // read in /proc — the live pane holding the session is the proof instead.
+  const runAs = require("../lib/run-as");
+  let live;
+  const paneHolds = (id) => {
+    if (live === undefined) live = require("../lib/tmux").liveSessions();
+    if (live === null) return true; // tmux could not answer: prove nothing, reap nothing
+    return db
+      .prepare(
+        "SELECT id FROM dashboard_runs WHERE session_id = ? AND status IN ('running', 'spawning')"
+      )
+      .all(id)
+      .some((r) => live.has(r.id));
+  };
   for (const sess of activeSessions) {
     // Household-hook-forwarded sessions report cwd in the ORIGIN machine's own
     // path syntax (e.g. Windows `D:\Git\ai-deck`). This probe only ever
@@ -2035,7 +2083,11 @@ function livenessReap({ ignoreIdleGate = false, asyncProbe = false, probe = null
     } catch {
       continue;
     }
-    if (probe.cwds.has(resolvedCwd)) continue;
+    // ownerForRead, never accountForPath: a disabled member's session must not
+    // throw here and stop the reap for every session after it.
+    if (runAs.ownerForRead(resolvedCwd)) {
+      if (paneHolds(sess.id)) continue;
+    } else if (probe.cwds.has(resolvedCwd)) continue;
     // lsof reports the OS's own path (/private/tmp on macOS); a session row may
     // hold the symlinked or differently-cased spelling of the same directory.
     try {