feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes/lane-sources.js

@@ -11,14 +11,16 @@
  */
 "use strict";
 
+const path = require("node:path");
 const express = require("express");
+const scope = require("../lib/scope");
 const sources = require("../lib/lane-sources");
 const lanesLib = require("../lib/lanes");
 const { sameOriginGuard } = require("../lib/same-origin");
 
 const router = express.Router();
 
-const STATUS = { ENOLANE: 404, ENOSOURCE: 404, ETOOBIG: 413, EBADORIGIN: 403 };
+const STATUS = { ENOLANE: 404, ENOSOURCE: 404, ETOOBIG: 413, EBADORIGIN: 403, EFOLDER: 403 };
 
 function sendError(res, err) {
   if (err && typeof err.code === "string" && /^E[A-Z]+$/.test(err.code)) {
@@ -83,7 +85,18 @@ router.put("/:id/instructions", sameOriginGuard, (req, res) => {
 router.post("/:id/sources/folder", sameOriginGuard, (req, res) => {
   try {
     const id = laneId(req);
-    sources.addFolder(id, (req.body || {}).path);
+    const input = (req.body || {}).path;
+    // A developer names only folders in their own home, checked BEFORE
+    // anything probes the path: the dashboard looks with its own rights
+    // (CAP_DAC_READ_SEARCH under S3), and its different answers would map
+    // other members' homes. Checked again on the real path it records.
+    const allowed = (p) => scope.folderAllowed(req, lanesLib.canonicalCwd(path.resolve(p)));
+    if (typeof input === "string" && input.trim() && !allowed(input)) {
+      throw Object.assign(new Error("an extra folder must be inside your own folder"), {
+        code: "EFOLDER",
+      });
+    }
+    sources.addFolder(id, input, { allowed });
     res.status(201).json(view(id));
   } catch (err) {
     sendError(res, err);