From 1f48c5b707ea0e97bd3af30023fb2be0bc7556a2 Mon Sep 17 00:00:00 2001
From: Hong Jiarong <me@jrhim.com>
Date: Sat, 11 Jul 2026 15:06:48 +0800
Subject: [PATCH] Revert "fix: provide capability for both SDK auth modes"

This reverts commit ebf870249f17cffa278a76fd7da2d02c8e2f5e3d.
---
 hub/package-lock.json                |  4 ++--
 hub/package.json                     |  2 +-
 hub/src/connections/providerProxy.ts | 19 ++-----------------
 hub/src/hub.ts                       |  1 -
 hub/test/unit/provider-proxy.test.ts |  9 ++-------
 5 files changed, 7 insertions(+), 28 deletions(-)

diff --git a/hub/package-lock.json b/hub/package-lock.json
index e09330d..27caf6d 100644
--- a/hub/package-lock.json
+++ b/hub/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.17",
+  "version": "0.0.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.17",
+      "version": "0.0.16",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
diff --git a/hub/package.json b/hub/package.json
index bb661ba..4a5ca67 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.17",
+  "version": "0.0.16",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/hub/src/connections/providerProxy.ts b/hub/src/connections/providerProxy.ts
index ab89e8f..b76a2fb 100644
--- a/hub/src/connections/providerProxy.ts
+++ b/hub/src/connections/providerProxy.ts
@@ -41,11 +41,6 @@ export interface ProviderProxyDiagnostic {
     | "provider_proxy_redirect_refused"
     | "provider_proxy_upstream_failed";
   readonly category: NetworkFailureCategory | "authorization" | "request_limit" | "redirect";
-  readonly authShape?: {
-    readonly bearerLength: number;
-    readonly apiKeyLength: number;
-    readonly expectedLength: number;
-  };
 }
 
 export interface ProviderProxyOptions {
@@ -85,7 +80,7 @@ export async function openProviderProxyLease(
   return {
     sdkEnv: {
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
-      ANTHROPIC_AUTH_TOKEN: capability,
+      ANTHROPIC_AUTH_TOKEN: "",
       ANTHROPIC_API_KEY: capability,
     },
     sensitiveValues: [capability],
@@ -108,17 +103,7 @@ async function forwardProviderRequest(
   options: ProviderProxyOptions,
 ): Promise<void> {
   if (!authorized(request.headers.authorization, header(request.headers["x-api-key"]), capability)) {
-    options.onDiagnostic?.({
-      code: "provider_proxy_unauthorized",
-      category: "authorization",
-      authShape: {
-        bearerLength: request.headers.authorization?.startsWith("Bearer ")
-          ? request.headers.authorization.length - "Bearer ".length
-          : 0,
-        apiKeyLength: header(request.headers["x-api-key"])?.length ?? 0,
-        expectedLength: capability.length,
-      },
-    });
+    options.onDiagnostic?.({ code: "provider_proxy_unauthorized", category: "authorization" });
     response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
     response.end("unauthorized");
     return;
diff --git a/hub/src/hub.ts b/hub/src/hub.ts
index af4eff0..bc24897 100644
--- a/hub/src/hub.ts
+++ b/hub/src/hub.ts
@@ -73,7 +73,6 @@ export async function startHub(): Promise<void> {
           providerId: context.providerId,
           errorCode: diagnostic.code,
           failureCategory: diagnostic.category,
-          authShape: diagnostic.authShape,
         }, "provider proxy diagnostic");
       },
     }),
diff --git a/hub/test/unit/provider-proxy.test.ts b/hub/test/unit/provider-proxy.test.ts
index bf4e6b7..3d2590b 100644
--- a/hub/test/unit/provider-proxy.test.ts
+++ b/hub/test/unit/provider-proxy.test.ts
@@ -52,10 +52,9 @@ describe("run-scoped provider proxy", () => {
     expect(serializedAgentEnv).not.toContain(String(address.port));
     expect(lease.sdkEnv).toMatchObject({
       ANTHROPIC_BASE_URL: expect.stringMatching(/^http:\/\/127\.0\.0\.1:\d+$/),
-      ANTHROPIC_AUTH_TOKEN: expect.any(String),
+      ANTHROPIC_AUTH_TOKEN: "",
       ANTHROPIC_API_KEY: expect.any(String),
     });
-    expect(lease.sdkEnv.ANTHROPIC_AUTH_TOKEN).toBe(lease.sdkEnv.ANTHROPIC_API_KEY);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
       method: "POST",
@@ -105,11 +104,7 @@ describe("run-scoped provider proxy", () => {
 
     expect(response.status).toBe(401);
     expect(upstreamRequests).toBe(0);
-    expect(diagnostics).toEqual([{
-      code: "provider_proxy_unauthorized",
-      category: "authorization",
-      authShape: { bearerLength: 0, apiKeyLength: 0, expectedLength: 43 },
-    }]);
+    expect(diagnostics).toEqual([{ code: "provider_proxy_unauthorized", category: "authorization" }]);
   });
 
   it("accepts the run capability in the Anthropic x-api-key header", async () => {