close the anthropic proxy secret, and re-close it on every boot

data/sidecar/claude-state.json holds proxySecret, and that string IS the
owner's Claude Max subscription: officer-anthropic-proxy accepts it as
x-api-key, swaps it for the owner's OAuth bearer and forwards to
api.anthropic.com. it listens on 127.0.0.1, which every local account can
reach.

it was 664 in a 775 directory. nothing had ever set a mode - mkdirSync and
Bun.write at ubuntu's default umask of 002. confirmed by reading the live
secret as 'nobody', an account with no relationship to the platform, and by
confirming the proxy 401s without the key so the secret is the only control.

this does NOT mean members shared the subscription. spawnClaudeAsMember runs
their claude through setpriv --reset-env with a six-name allowlist, so
ANTHROPIC_BASE_URL and ANTHROPIC_API_KEY cannot cross into it and their turns
go straight to anthropic on their own OAuth. that design is intact - it could
just be walked around by anyone with a shell.

fixed twice on purpose. state.ts sets 0600/0700 on every write, which is the
authoritative fix, and on every write rather than at creation because
writeFileSync leaves an existing file's mode alone. secureRuntimeSecrets()
sweeps at boot because officer-anthropic-proxy is a separate pm2 process that
can recreate the file hours after officer started, and because every existing
install has the old mode until something repairs it.

it repairs rather than refusing to boot, unlike assertSecretsClosed beside it.
the line is who wrote the file: .env is the installer's and we must not guess
at it; this is our own output at the machine's umask, so refusing to start
would punish the user for our bug.

the per-account copies are swept too. no live secret in them today, but they
map session keys to transcript uuids for named accounts.

tests verified to bite: removing the chmod while still reporting success fails
four of them.

a chmod does not undo exposure - the secret still needs rotating on the
production host. TODO.md has the sequence, including that officer-claude-code
caches it and must be restarted alongside the proxy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server.tsx

@@ -8,7 +8,7 @@ import { refreshPluginMounts, snapshotPlugins } from './servers/plugins/mount';
 import { generatePluginsModule, rebuildFrontend, BUILD_DIR, SHELL_FILE } from './servers/plugins/generate';
 import { assertInstallLayout } from './servers/data-path';
 import { PORT } from './servers/officer-url.mjs';
-import { assertSecretsClosed } from './servers/os-user';
+import { assertSecretsClosed, secureRuntimeSecrets } from './servers/os-user';
 import { resolveHomeDir } from './servers/user-home';
 import { resolveAuthToken } from './servers/auth-token';
 import { isWsProviderAllowed } from './servers/permissions/authorize';
@@ -167,6 +167,20 @@ assertInstallLayout();
 // JWT_SECRET is worse than no isolation, because the model looks intact.
 await assertSecretsClosed(process.cwd());
 
+// Then close the ones the platform writes ITSELF, which is a repair rather than a refusal — see
+// `secureRuntimeSecrets`. It runs on every boot because `officer-anthropic-proxy` is a separate PM2
+// process that can recreate its state file at the machine's umask hours after this one started, and
+// because the file it protects is the owner's Claude Max subscription in string form.
+const secured = await secureRuntimeSecrets();
+if (secured.repaired.length) {
+  console.warn(
+    `[boot] closed ${secured.repaired.length} world-readable platform secret(s): ${secured.repaired.join(', ')}\n` +
+      '       If this names sidecar/claude-state.json, the proxy secret was readable by every account on\n' +
+      '       this machine and should be ROTATED, not just closed — the mode is fixed, the string is not.',
+  );
+}
+for (const path of secured.failed) console.error(`[boot] could not close ${path} — check its owner and mode`);
+
 // Mount whatever is installed, BEFORE serve().
 //
 // Without this a restart silently unmounts every plugin: `honoServer` is built with none at import,