feat: secure organization provider credentials

hub/test/integration/trigger.test.ts

@@ -30,13 +30,16 @@ function makeTestSettings(models: InMemoryModelRegistry): RuntimeSettings {
     async provider(providerId) {
       return {
         id: providerId,
-        baseUrl: "https://openrouter.ai/api",
-        authToken: "test-token",
-        anthropicApiKey: "",
-        sdkEnv: {
-          ANTHROPIC_BASE_URL: "https://openrouter.ai/api",
-          ANTHROPIC_AUTH_TOKEN: "test-token",
-          ANTHROPIC_API_KEY: "",
+        async openAgentLease() {
+          return {
+            sdkEnv: {
+              ANTHROPIC_BASE_URL: "http://127.0.0.1:12345",
+              ANTHROPIC_AUTH_TOKEN: "test-run-capability",
+              ANTHROPIC_API_KEY: "",
+            },
+            sensitiveValues: ["test-run-capability"],
+            async close() {},
+          };
         },
       };
     },
@@ -153,9 +156,9 @@ describe("trigger full lifecycle (integration)", () => {
     });
     expect(rt.sentTexts.some((text) => text.includes("mock response") && text.includes("本次成本: $0.0023"))).toBe(true);
     expect(runAgentCalls).toHaveLength(1);
-    expect(runAgentCalls[0]?.providerEnv).toMatchObject({
-      ANTHROPIC_BASE_URL: "https://openrouter.ai/api",
-      ANTHROPIC_AUTH_TOKEN: "test-token",
+    expect(runAgentCalls[0]?.providerProxyEnv).toMatchObject({
+      ANTHROPIC_BASE_URL: "http://127.0.0.1:12345",
+      ANTHROPIC_AUTH_TOKEN: "test-run-capability",
       ANTHROPIC_API_KEY: "",
     });
     expect(runAgentCalls[0]?.maxTurns).toBe(7);