platform/COMMS/sidecar-app-store/29-history-layer.md

29 — the history layer is off getOwnerHomeDir

The owner asked me to carry on, so 27's "tomorrow" became tonight. This is the change I said I would not make at this hour, made at this hour — review it accordingly, and I would rather you were slow about it than quick.

What moved

claude-sessions.ts no longer knows how to invent a home. claudeHome(email) is gone. Every transcript read now takes a ChatIdentity { email, home }, and the home arrives resolved from resolveHomeDir(userId).

The old line was process.env.HOME_DIR ?? join(DATA_PATH, email, 'home') — which discards its argument whenever HOME_DIR is set, i.e. always on a real install. So every read resolved to the owner's ~/.claude regardless of who asked, and the comment above it asserted "single-user platform" as though that were a property rather than an assumption.

Both halves travel together rather than one standing in for the other, because they are genuinely different: general_chat_sessions lives under DATA_PATH/<email>, not under a home, so those paths stay email-derived. Collapsing them would have been the same class of mistake as undefined meaning "the owner".

chat.ts resolves the identity per request (chatIdentity), and throws FORBIDDEN rather than falling back — same posture as resolveTurnIdentity, for the same reason.

websocket.ts's resolveCwd takes a home rather than an email, so ~ expands against the caller's own home. Its old comment — "the server owner is the only account, absolute paths are theirs to use" — is replaced with what is actually true now: an absolute path still passes through, and it is the kernel that decides what a member's turn can open, not a string check here.

Ordering worth checking: identity is resolved before the cwd, because expanding ~ before knowing whose home it is would be exactly the bug this removes. That reordering also let me delete a second resolveTurnIdentity call that 25 had left further down the same function.

agent-runner.ts passes { email, home: homeDir } explicitly — it is an owner-only path, and I would rather it state that than inherit it.

What I am least sure of

1. chatIdentity throws where the old code could not fail. Every /chat route now has a failure mode it did not have. Owner-only today, and resolveHomeDir returns isOwner from a positive check — but it is the kind of change that turns a database blip into a 403 on a screen that used to always load.
2. resolveBaseCwd is exported. I changed its parameter from email to home and followed the compiler; if anything outside this diff passes an email, tsgo would have caught it, but the meaning of a wrong-but- well-typed string would not be caught by anything.
3. The regex pass. I rewrote bare email references inside chat.ts mechanically and then repaired the damage by hand. tsgo is clean and 78 tests pass, but that is a weaker guarantee than usual for this file.

tsgo clean, 78 tests, both gates up, member unreachable in production.

What is left

Nothing I can write blind. deprovisionOsAccount is still mine and still tomorrow's. A member signing in, the first member turn, and the gates are the owner's.