feat: secure organization provider credentials

hub/test/unit/runtime-settings.test.ts

@@ -15,44 +15,16 @@ describe("runtime settings", () => {
     expect((await settings.modelRegistry()).resolve(undefined, "draft")).toBe("z-ai/glm-4.7");
   });
 
-  it("returns provider SDK env without requiring global process env mutation", async () => {
+  it("refuses process-global provider credentials even when they are present", async () => {
     const settings = createEnvRuntimeSettings({
       ANTHROPIC_BASE_URL: "https://example.test/api",
       ANTHROPIC_AUTH_TOKEN: "openrouter-token",
       ANTHROPIC_API_KEY: "explicit-api-key",
     });
 
-    await expect(settings.provider("openrouter")).resolves.toMatchObject({
-      id: "openrouter",
-      baseUrl: "https://example.test/api",
-      authToken: "openrouter-token",
-      anthropicApiKey: "explicit-api-key",
-      sdkEnv: {
-        ANTHROPIC_BASE_URL: "https://example.test/api",
-        ANTHROPIC_AUTH_TOKEN: "openrouter-token",
-        ANTHROPIC_API_KEY: "explicit-api-key",
-      },
-    });
-  });
-
-  it("defaults Anthropic API key to empty for OpenRouter's Anthropic skin", async () => {
-    const settings = createEnvRuntimeSettings({
-      ANTHROPIC_AUTH_TOKEN: "openrouter-token",
-    });
-
-    await expect(settings.provider("openrouter")).resolves.toMatchObject({
-      baseUrl: "https://openrouter.ai/api",
-      anthropicApiKey: "",
-      sdkEnv: {
-        ANTHROPIC_API_KEY: "",
-      },
-    });
-  });
-
-  it("requires an auth token for the OpenRouter provider", async () => {
-    const settings = createEnvRuntimeSettings({});
-
-    await expect(settings.provider("openrouter")).rejects.toThrow("missing required runtime setting: ANTHROPIC_AUTH_TOKEN");
+    await expect(settings.provider("openrouter")).rejects.toThrow(
+      "process-global provider credentials are disabled",
+    );
   });
 
   it("honors HUB_AGENT_MAX_TURNS as a runtime run policy", async () => {