From 63c86322dedb98ee7de9a61053434eb3bacfa794 Mon Sep 17 00:00:00 2001
From: Hong Jiarong <me@jrhim.com>
Date: Sat, 11 Jul 2026 15:00:34 +0800
Subject: [PATCH] fix: preserve run provider capability

---
 hub/package-lock.json                | 4 ++--
 hub/package.json                     | 2 +-
 hub/src/agent/security.ts            | 9 +++------
 hub/test/unit/agent-security.test.ts | 5 +----
 hub/test/unit/runner.test.ts         | 5 +----
 5 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/hub/package-lock.json b/hub/package-lock.json
index e09330d..f569594 100644
--- a/hub/package-lock.json
+++ b/hub/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.17",
+      "version": "0.0.18",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
diff --git a/hub/package.json b/hub/package.json
index bb661ba..6126130 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/hub/src/agent/security.ts b/hub/src/agent/security.ts
index 1f7dfc3..7601c3e 100644
--- a/hub/src/agent/security.ts
+++ b/hub/src/agent/security.ts
@@ -23,11 +23,6 @@ const SAFE_HOST_ENV_KEYS = [
   "CPH_BIN",
 ] as const;
 
-const SANDBOX_HIDDEN_ENV_KEYS = [
-  "ANTHROPIC_AUTH_TOKEN",
-  "ANTHROPIC_API_KEY",
-] as const;
-
 // Linux sockaddr_un.sun_path is 108 bytes including the terminator. Claude's
 // sandbox appends its own user directory and randomized bridge socket names,
 // so keep our prefix well below that hard limit.
@@ -156,7 +151,9 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),
-        envVars: SANDBOX_HIDDEN_ENV_KEYS.map((name) => ({ name, mode: "deny" as const })),
+        // These values are short-lived loopback capabilities, not Organization
+        // provider secrets. Denying them also strips Claude's own request auth.
+        envVars: [],
       },
     },
   };
diff --git a/hub/test/unit/agent-security.test.ts b/hub/test/unit/agent-security.test.ts
index e359a83..2f3703a 100644
--- a/hub/test/unit/agent-security.test.ts
+++ b/hub/test/unit/agent-security.test.ts
@@ -66,10 +66,7 @@ describe("agent subprocess security policy", () => {
         allowRead: expect.arrayContaining([canonicalWorkspace, "/usr/bin"]),
       },
       credentials: {
-        envVars: expect.arrayContaining([
-          { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-          { name: "ANTHROPIC_API_KEY", mode: "deny" },
-        ]),
+        envVars: [],
       },
     });
   });
diff --git a/hub/test/unit/runner.test.ts b/hub/test/unit/runner.test.ts
index 7ddd450..f423473 100644
--- a/hub/test/unit/runner.test.ts
+++ b/hub/test/unit/runner.test.ts
@@ -288,10 +288,7 @@ describe("runAgent", () => {
         },
         sandbox: {
           credentials: {
-            envVars: expect.arrayContaining([
-              { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-              { name: "ANTHROPIC_API_KEY", mode: "deny" },
-            ]),
+            envVars: [],
           },
         },
       },