fix: v2.7.4 — a developer's System page carries no host or other-user path

- GET /api/settings/info for a developer: no DB path, no hooks file path,
  and no transcript-cache keys — those were EVERY user's transcript paths
  (their folders and session ids). GET /api/updates/status: no repo_root.
  Test: server-mode-leaks.
- Also in this release (earlier commits): a member's missing workspace
  folder is made as them at start; --allow-dangerously-skip-permissions only
  for an account that accepted the bypass warning or a bypass run.
Full suites: server 2889/2889, client 1250/1250, tsc -b.

server/__tests__/server-mode-leaks.test.js

@@ -148,3 +148,23 @@ describe("server mode: a member's skills/commands come from their own workspaces
     assert.ok(names(r).includes("max-skill"));
   });
 });
+
+describe("the System page's facts for a developer", () => {
+  // Every string that looks like an absolute path, anywhere in a body.
+  const paths = (o, out = []) => {
+    if (typeof o === "string" && o.startsWith("/")) out.push(o);
+    else if (o && typeof o === "object") for (const v of Object.values(o)) paths(v, out);
+    return out;
+  };
+
+  it("carries no host or other-user path (DB, hooks file, transcript cache keys)", async () => {
+    const mia = await login("mia", "member-pass-1");
+    const info = await call("/api/settings/info", mia);
+    assert.equal(info.status, 200);
+    assert.deepEqual(paths(info.body), []);
+    assert.equal(typeof info.body.db.size, "number", "the numbers stay");
+    const boss = await login("boss", "admin-pass-1");
+    const full = await call("/api/settings/info", boss);
+    assert.ok(full.body.db.path, "an admin still sees the host's paths");
+  });
+});

server/routes/settings.js

@@ -35,7 +35,7 @@ const {
   importExportBundle,
   exportableRun,
 } = require("../lib/data-transfer");
-const { sessionWhere, bySessionWhere } = require("../lib/scope");
+const { sessionWhere, bySessionWhere, memberId } = require("../lib/scope");
 
 function getDbSize() {
   try {
@@ -127,15 +127,20 @@ router.get("/info", (req, res) => {
     h1: getCount(60 * 60 * 1000),
   };
 
+  // A developer (server mode) gets the numbers, never a path of the host's:
+  // the transcript cache is keyed by EVERY user's transcript path (their
+  // folders, their session ids), and the DB/settings paths are the host's.
+  const developer = memberId(req) != null;
+  const cache = transcriptCache.stats();
   res.json({
     db: {
-      path: DB_PATH,
+      path: developer ? null : DB_PATH,
       size: dbSize,
       counts,
       pragmas,
       load_stats,
     },
-    hooks: hookStatus,
+    hooks: developer ? { installed: hookStatus.installed } : hookStatus,
     server: {
       version: APP_VERSION,
       uptime: process.uptime(),
@@ -152,7 +157,7 @@ router.get("/info", (req, res) => {
       free_mem: os.freemem(),
       cpus: os.cpus().length,
     },
-    transcript_cache: transcriptCache.stats(),
+    transcript_cache: developer ? { ...cache, keys: undefined } : cache,
   });
 });
 

server/routes/updates.js

@@ -24,9 +24,11 @@ const { schedulePluginUpdate } = require("../lib/plugin-update");
 
 const router = Router();
 
-router.get("/status", async (_req, res) => {
+router.get("/status", async (req, res) => {
   try {
     const status = await getUpdatesStatus();
+    // The install folder is the host's; a developer sees versions only.
+    if (require("../lib/scope").memberId(req) != null) status.repo_root = null;
     res.json(status);
   } catch (err) {
     res.status(500).json({