prefix the env with OFFICERDEV_, and keep reading the bare names

PORT, PUBLIC_URL and POSTGRES_URL are names half the software in the world
uses. Bun auto-loads .env into EVERY process started in the platform directory,
so a bare PORT reaches the sidecars, the tools they spawn and anything an agent
runs from here — and a bare POSTGRES_URL reaches things with no business
holding a database credential.

Four parts.

officer-setup now writes OFFICERDEV_-prefixed names, with the reasoning in the
generated file so whoever opens it later knows why.

Every consumer reads `OFFICERDEV_X ?? X` — eleven sites across the databases,
the DAV router, officer-url.mjs, os-user-postgres and two scripts. The bare
name is the FALLBACK, never the source, which is what makes this safe to ship
before every machine has been converted.

`bun run fix:env` converts a file in place. Idempotent, preserves comments and
`export`, leaves the value untouched including an `=` inside it, and refuses to
touch names belonging to other software — prefixing PATH or NODE_ENV does not
rename a variable, it deletes it.

And it runs on every restart from the server settings screen. There rather than
at boot because a restart is the one moment the file can be rewritten and take
effect in the same breath: the process about to start is the one that reads it.
Non-fatal, since the fallback means the worst case is that nothing changed.

gen-index reads either spelling out of the file directly, because it is run by
hand as often as by the setup and a bare shell has no .env loaded.

Verified by converting this machine's own .env: PORT, PUBLIC_URL and the
database all still resolve, gen:index still finds its URL, 1152 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/fix-env.ts

@@ -0,0 +1,14 @@
+// `bun run fix:env` — give every variable in `.env` the `OFFICERDEV_` prefix.
+//
+// A thin front for `servers/env-prefix.ts`, which is where the rules live. Deliberately that way round:
+// the same conversion runs on every restart from the server settings screen, and a router reaching into
+// `scripts/` to do it would make a maintenance script part of the request path.
+
+import { join } from 'node:path';
+import { fixEnvFile } from '../src/servers/env-prefix';
+
+const path = process.argv[2] ?? join(process.cwd(), '.env');
+const { changed, alreadyPrefixed } = fixEnvFile(path);
+
+if (changed.length) console.log(`[fix:env] prefixed ${changed.length}: ${changed.join(', ')}`);
+else console.log(`[fix:env] nothing to do (${alreadyPrefixed} already prefixed)`);

scripts/gen-index.ts

@@ -27,17 +27,23 @@ const output = join(root, 'src/apps/officer-web/index.gen.html');
 const argUrl = process.argv[2]?.trim();
 
 const envPath = join(root, '.env');
-if (!argUrl && !process.env.PUBLIC_URL && existsSync(envPath)) {
+// Prefixed first, bare as the fallback — the same rule every other consumer follows. This script reads
+// the file itself rather than relying on the environment, because it is run by hand as often as by the
+// setup, and `bun run gen:index` in a bare shell has no `.env` loaded.
+const envValue = (): string | undefined => process.env.OFFICERDEV_PUBLIC_URL ?? process.env.PUBLIC_URL;
+
+if (!argUrl && !envValue() && existsSync(envPath)) {
   for (const line of (await Bun.file(envPath).text()).split('\n')) {
-    const match = line.match(/^\s*PUBLIC_URL\s*=\s*(.*)$/);
-    if (match) process.env.PUBLIC_URL = match[1]!.trim().replace(/^["']|["']$/g, '');
+    // Either spelling, so a file that has been through `bun run fix:env` and one that has not both work.
+    const match = line.match(/^\s*(?:OFFICERDEV_)?PUBLIC_URL\s*=\s*(.*)$/);
+    if (match) process.env.OFFICERDEV_PUBLIC_URL = match[1]!.trim().replace(/^["']|["']$/g, '');
   }
 }
 
-const publicUrl = (argUrl || process.env.PUBLIC_URL || '').replace(/\/+$/, '');
+const publicUrl = (argUrl || envValue() || '').replace(/\/+$/, '');
 if (!publicUrl) {
   console.error('[gen-index] no public URL. Pass one — `bun gen:index https://officer.example.com` —');
-  console.error('[gen-index] or set PUBLIC_URL in .env.');
+  console.error('[gen-index] or set OFFICERDEV_PUBLIC_URL in .env.');
   process.exit(1);
 }
 

scripts/rename-capabilities-to-permissions.ts

@@ -37,7 +37,7 @@ import postgres from 'postgres';
 // `role === 'Super Admin'` before it reads the table at all, so the account that can fix things can
 // always sign in. Non-owners degrade to core-only until the rename completes.
 
-const url = process.env.POSTGRES_URL;
+const url = process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL;
 if (!url) {
   console.error('  POSTGRES_URL is not set. Run from the platform directory so Bun loads .env.');
   process.exit(1);

scripts/setup/officer-setup/lib/env.sh

@@ -60,13 +60,22 @@ write_env() {
 #
 # Everything Officer reads at runtime. Kept at 0600 and owned by ${USERNAME}: it
 # holds the token-signing secret and the database credential.
+#
+# EVERY NAME IS PREFIXED \`OFFICERDEV_\`. Bun auto-loads this file into every
+# process started in the platform directory, so a bare PORT or POSTGRES_URL
+# reaches the sidecars, the tools they spawn and anything an agent runs from
+# here — names half the software in the world already uses. Prefixed, they
+# cannot be picked up by accident.
+#
+# Every consumer reads \`OFFICERDEV_X ?? X\`, so an older unprefixed file still
+# works. \`bun run fix:env\` converts one in place.
 
-PORT="${ENV_PORT}"
+OFFICERDEV_PORT="${ENV_PORT}"
 
 # Where Officer is reached from a browser. Not derivable — see the section.
-PUBLIC_URL="${ENV_PUBLIC_URL}"
+OFFICERDEV_PUBLIC_URL="${ENV_PUBLIC_URL}"
 
-POSTGRES_URL="${POSTGRES_URL}"
+OFFICERDEV_POSTGRES_URL="${POSTGRES_URL}"
 
 ENVF