fix: provide capability for both SDK auth modes

hub/src/connections/providerProxy.ts

@@ -41,6 +41,11 @@ export interface ProviderProxyDiagnostic {
     | "provider_proxy_redirect_refused"
     | "provider_proxy_upstream_failed";
   readonly category: NetworkFailureCategory | "authorization" | "request_limit" | "redirect";
+  readonly authShape?: {
+    readonly bearerLength: number;
+    readonly apiKeyLength: number;
+    readonly expectedLength: number;
+  };
 }
 
 export interface ProviderProxyOptions {
@@ -80,7 +85,7 @@ export async function openProviderProxyLease(
   return {
     sdkEnv: {
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
-      ANTHROPIC_AUTH_TOKEN: "",
+      ANTHROPIC_AUTH_TOKEN: capability,
       ANTHROPIC_API_KEY: capability,
     },
     sensitiveValues: [capability],
@@ -103,7 +108,17 @@ async function forwardProviderRequest(
   options: ProviderProxyOptions,
 ): Promise<void> {
   if (!authorized(request.headers.authorization, header(request.headers["x-api-key"]), capability)) {
-    options.onDiagnostic?.({ code: "provider_proxy_unauthorized", category: "authorization" });
+    options.onDiagnostic?.({
+      code: "provider_proxy_unauthorized",
+      category: "authorization",
+      authShape: {
+        bearerLength: request.headers.authorization?.startsWith("Bearer ")
+          ? request.headers.authorization.length - "Bearer ".length
+          : 0,
+        apiKeyLength: header(request.headers["x-api-key"])?.length ?? 0,
+        expectedLength: capability.length,
+      },
+    });
     response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
     response.end("unauthorized");
     return;

hub/src/hub.ts

@@ -73,6 +73,7 @@ export async function startHub(): Promise<void> {
           providerId: context.providerId,
           errorCode: diagnostic.code,
           failureCategory: diagnostic.category,
+          authShape: diagnostic.authShape,
         }, "provider proxy diagnostic");
       },
     }),