anthropic auth proxy for multi-user claude code

Local HTTP proxy on 127.0.0.1:5051 intercepts Claude Code API requests
from sandboxed member users, injects the real OAuth token server-side,
and forwards to Anthropic. Users only see a proxy secret, never the
real credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server.tsx

@@ -12,6 +12,7 @@ import { desktopWebsocket } from './servers/api/desktop/websocket';
 import { findEntryByProxyId, touchEntry } from './servers/api/dev-server/router';
 import officerWeb from './apps/officer-web/index.html';
 import { startBrowserRelay } from './servers/api/browser/relay';
+import { startAnthropicProxy } from './servers/api/anthropic-proxy';
 import { toShellUsername } from './servers/data-path';
 
 const { PORT = '5000' } = process.env;
@@ -228,6 +229,12 @@ try {
   console.error('[browser-relay] failed to start:', err instanceof Error ? err.message : err);
 }
 
+try {
+  startAnthropicProxy();
+} catch (err) {
+  console.error('[anthropic-proxy] failed to start:', err instanceof Error ? err.message : err);
+}
+
 
 void initTerminalSidecars();