prefix the env with OFFICERDEV_, and keep reading the bare names

PORT, PUBLIC_URL and POSTGRES_URL are names half the software in the world
uses. Bun auto-loads .env into EVERY process started in the platform directory,
so a bare PORT reaches the sidecars, the tools they spawn and anything an agent
runs from here — and a bare POSTGRES_URL reaches things with no business
holding a database credential.

Four parts.

officer-setup now writes OFFICERDEV_-prefixed names, with the reasoning in the
generated file so whoever opens it later knows why.

Every consumer reads `OFFICERDEV_X ?? X` — eleven sites across the databases,
the DAV router, officer-url.mjs, os-user-postgres and two scripts. The bare
name is the FALLBACK, never the source, which is what makes this safe to ship
before every machine has been converted.

`bun run fix:env` converts a file in place. Idempotent, preserves comments and
`export`, leaves the value untouched including an `=` inside it, and refuses to
touch names belonging to other software — prefixing PATH or NODE_ENV does not
rename a variable, it deletes it.

And it runs on every restart from the server settings screen. There rather than
at boot because a restart is the one moment the file can be rewritten and take
effect in the same breath: the process about to start is the one that reads it.
Non-fatal, since the fallback means the worst case is that nothing changed.

gen-index reads either spelling out of the file directly, because it is run by
hand as often as by the setup and a bare shell has no .env loaded.

Verified by converting this machine's own .env: PORT, PUBLIC_URL and the
database all still resolve, gen:index still finds its URL, 1152 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/databases/marketplace_db/drizzle.config.ts

@@ -20,7 +20,7 @@ try {
 // because drizzle-kit loads this file outside the workspace's module resolution.
 const url = (() => {
   if (process.env.MARKETPLACE_POSTGRES_URL) return process.env.MARKETPLACE_POSTGRES_URL;
-  const base = process.env.POSTGRES_URL;
+  const base = process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL;
   if (!base) throw new Error('MARKETPLACE_POSTGRES_URL or POSTGRES_URL is required');
   const parsed = new URL(base);
   parsed.pathname = '/officer_marketplace';

src/databases/marketplace_db/src/db.ts

@@ -31,7 +31,7 @@ export function marketplaceUrl(): string {
   const explicit = process.env.MARKETPLACE_POSTGRES_URL;
   if (explicit) return explicit;
 
-  const base = process.env.POSTGRES_URL;
+  const base = process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL;
   if (!base) throw new Error('MARKETPLACE_POSTGRES_URL or POSTGRES_URL is required');
 
   // Swap only the path. Parsing rather than string-replacing, so a password containing the database

src/databases/officer_db/drizzle.config.ts

@@ -20,6 +20,6 @@ export default defineConfig({
   out: './migrations',
   dialect: 'postgresql',
   dbCredentials: {
-    url: process.env.POSTGRES_URL!,
+    url: (process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL)!,
   },
 });

src/databases/officer_db/src/db.ts

@@ -2,7 +2,11 @@ import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 import * as schema from './schema';
 
-const { POSTGRES_URL } = process.env;
+// Prefixed first, bare as the fallback. Bun auto-loads `.env` into every process started in this
+// directory, so an unprefixed POSTGRES_URL reaches sidecars and anything an agent spawns — none of
+// which has business holding a database credential. `bun run fix:env` does the rename; the fallback
+// is what lets an install that has not run it keep working.
+const POSTGRES_URL = process.env.OFFICERDEV_POSTGRES_URL ?? process.env.POSTGRES_URL;
 
 if (!POSTGRES_URL) {
   throw new Error('POSTGRES_URL environment variable is required');