feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes/sessions.js

@@ -6,15 +6,14 @@
 const { Router } = require("express");
 const fs = require("fs");
 const path = require("path");
-const readline = require("readline");
 const { stmts, db } = require("../db");
 const { broadcast } = require("../websocket");
 const { calculateCost, attachAgentCosts } = require("./pricing");
 const { parseSources, sourceColumnClause } = require("../lib/source-filter");
 const { memberId, sessionWhere, canSeeSession } = require("../lib/scope");
 const {
-  getClaudeHome,
-  getProjectsDir,
+  projectsDirFor,
+  sessionProjectsDirs,
   getTranscriptPath,
   getSubagentTranscriptPath,
   getSnapshotTranscriptPath,
@@ -110,15 +109,8 @@ function classifyTranscriptSender(entry, isSubagentFile) {
  * Avoids loading the entire file into memory.
  */
 async function readFirstLine(filePath) {
-  const rl = readline.createInterface({
-    input: fs.createReadStream(filePath, { encoding: "utf8" }),
-    crlfDelay: Infinity,
-  });
-  for await (const line of rl) {
-    rl.close();
-    rl.removeAllListeners();
-    return line;
-  }
+  // readLines, never readline: a member's one-line 512 MB file crashes readline.
+  for await (const line of require("../lib/run-as").readLines(filePath)) return line;
   return null;
 }
 
@@ -504,7 +496,7 @@ router.get("/:id/transcripts", async (req, res) => {
   // Main session transcript (live, else the durable import-time snapshot)
   const mainPath =
     getTranscriptPath(req.params.id, session.cwd) ||
-    findTranscriptPath(req.params.id) ||
+    findTranscriptPath(req.params.id, session.cwd) ||
     getSnapshotTranscriptPath(req.params.id);
   if (mainPath && fs.existsSync(mainPath)) {
     // Main agent database ID format: <sessionId>-main
@@ -524,22 +516,24 @@ router.get("/:id/transcripts", async (req, res) => {
 
   // Direct path
   if (encoded) {
-    const directDir = path.join(getProjectsDir(), encoded, req.params.id, "subagents");
+    // A member's session (S3) wrote under their own home.
+    const directDir = path.join(projectsDirFor(session.cwd), encoded, req.params.id, "subagents");
     if (fs.existsSync(directDir)) subagentDirs.push(directDir);
   }
 
-  // Fallback: scan all project directories when direct path doesn't exist
+  // Fallback: scan the owner's project directory when the direct path doesn't exist
   if (subagentDirs.length === 0) {
-    const projectsDir = path.join(getClaudeHome(), "projects");
-    if (fs.existsSync(projectsDir)) {
-      try {
-        for (const d of fs.readdirSync(projectsDir, { withFileTypes: true })) {
-          if (!d.isDirectory()) continue;
-          const candidate = path.join(projectsDir, d.name, req.params.id, "subagents");
-          if (fs.existsSync(candidate)) subagentDirs.push(candidate);
+    for (const projectsDir of sessionProjectsDirs(session.cwd)) {
+      if (fs.existsSync(projectsDir)) {
+        try {
+          for (const d of fs.readdirSync(projectsDir, { withFileTypes: true })) {
+            if (!d.isDirectory()) continue;
+            const candidate = path.join(projectsDir, d.name, req.params.id, "subagents");
+            if (fs.existsSync(candidate)) subagentDirs.push(candidate);
+          }
+        } catch {
+          /* ignore */
         }
-      } catch {
-        /* ignore */
       }
     }
   }
@@ -556,7 +550,7 @@ router.get("/:id/transcripts", async (req, res) => {
         const metaPath = path.join(dir, file.replace(".jsonl", ".meta.json"));
         if (fs.existsSync(metaPath)) {
           try {
-            meta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
+            meta = JSON.parse(require("../lib/run-as").readFileSafe(metaPath, "utf8", { max: 1 << 20 }));
           } catch {
             /* ignore */
           }
@@ -730,12 +724,12 @@ router.get("/:id/transcript", async (req, res) => {
   } else if (agentId && agentId !== "main") {
     jsonlPath =
       getSubagentTranscriptPath(req.params.id, session.cwd, agentId, runId) ||
-      findSubagentTranscriptPath(req.params.id, agentId, runId) ||
+      findSubagentTranscriptPath(req.params.id, agentId, runId, session.cwd) ||
       getSnapshotSubagentTranscriptPath(req.params.id, agentId, runId);
   } else {
     jsonlPath =
       getTranscriptPath(req.params.id, session.cwd) ||
-      findTranscriptPath(req.params.id) ||
+      findTranscriptPath(req.params.id, session.cwd) ||
       getSnapshotTranscriptPath(req.params.id);
   }
 
@@ -752,10 +746,8 @@ router.get("/:id/transcript", async (req, res) => {
     let total = 0; // total valid messages seen (exact for early-terminated streams, indicates >= actual)
     let hasMore = false;
 
-    const rl = readline.createInterface({
-      input: fs.createReadStream(jsonlPath, { encoding: "utf8" }),
-      crlfDelay: Infinity,
-    });
+    // readLines, never readline: a member's one-line 512 MB file crashes readline.
+    const rl = require("../lib/run-as").readLines(jsonlPath);
 
     const renders = isCodex
       ? (e) => e.type === "response_item"
@@ -938,8 +930,6 @@ router.get("/:id/transcript", async (req, res) => {
         if (messages.length >= limit) {
           // Check if there's at least one more valid message
           hasMore = true;
-          rl.close();
-          rl.removeAllListeners();
           break;
         }
       }
@@ -961,8 +951,6 @@ router.get("/:id/transcript", async (req, res) => {
         if (!renders(entry)) continue;
         if (lineNum >= beforeLine) {
           // Reached the boundary — stop reading
-          rl.close();
-          rl.removeAllListeners();
           break;
         }
 
@@ -1001,8 +989,6 @@ router.get("/:id/transcript", async (req, res) => {
         messages.push(message);
         if (messages.length >= limit) {
           hasMore = true; // assume more exist
-          rl.close();
-          rl.removeAllListeners();
           break;
         }
       }