fix: preserve run provider capability

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.16",
+      "version": "0.0.18",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "private": true,
   "type": "module",
   "engines": {

hub/src/agent/security.ts

@@ -23,11 +23,6 @@ const SAFE_HOST_ENV_KEYS = [
   "CPH_BIN",
 ] as const;
 
-const SANDBOX_HIDDEN_ENV_KEYS = [
-  "ANTHROPIC_AUTH_TOKEN",
-  "ANTHROPIC_API_KEY",
-] as const;
-
 // Linux sockaddr_un.sun_path is 108 bytes including the terminator. Claude's
 // sandbox appends its own user directory and randomized bridge socket names,
 // so keep our prefix well below that hard limit.
@@ -156,7 +151,9 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),
-        envVars: SANDBOX_HIDDEN_ENV_KEYS.map((name) => ({ name, mode: "deny" as const })),
+        // These values are short-lived loopback capabilities, not Organization
+        // provider secrets. Denying them also strips Claude's own request auth.
+        envVars: [],
       },
     },
   };

hub/src/connections/providerProxy.ts

@@ -41,6 +41,11 @@ export interface ProviderProxyDiagnostic {
     | "provider_proxy_redirect_refused"
     | "provider_proxy_upstream_failed";
   readonly category: NetworkFailureCategory | "authorization" | "request_limit" | "redirect";
+  readonly authShape?: {
+    readonly bearerLength: number;
+    readonly apiKeyLength: number;
+    readonly expectedLength: number;
+  };
 }
 
 export interface ProviderProxyOptions {
@@ -80,7 +85,7 @@ export async function openProviderProxyLease(
   return {
     sdkEnv: {
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
-      ANTHROPIC_AUTH_TOKEN: "",
+      ANTHROPIC_AUTH_TOKEN: capability,
       ANTHROPIC_API_KEY: capability,
     },
     sensitiveValues: [capability],
@@ -103,7 +108,17 @@ async function forwardProviderRequest(
   options: ProviderProxyOptions,
 ): Promise<void> {
   if (!authorized(request.headers.authorization, header(request.headers["x-api-key"]), capability)) {
-    options.onDiagnostic?.({ code: "provider_proxy_unauthorized", category: "authorization" });
+    options.onDiagnostic?.({
+      code: "provider_proxy_unauthorized",
+      category: "authorization",
+      authShape: {
+        bearerLength: request.headers.authorization?.startsWith("Bearer ")
+          ? request.headers.authorization.length - "Bearer ".length
+          : 0,
+        apiKeyLength: header(request.headers["x-api-key"])?.length ?? 0,
+        expectedLength: capability.length,
+      },
+    });
     response.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
     response.end("unauthorized");
     return;

hub/src/hub.ts

@@ -73,6 +73,7 @@ export async function startHub(): Promise<void> {
           providerId: context.providerId,
           errorCode: diagnostic.code,
           failureCategory: diagnostic.category,
+          authShape: diagnostic.authShape,
         }, "provider proxy diagnostic");
       },
     }),

hub/test/unit/agent-security.test.ts

@@ -66,10 +66,7 @@ describe("agent subprocess security policy", () => {
         allowRead: expect.arrayContaining([canonicalWorkspace, "/usr/bin"]),
       },
       credentials: {
-        envVars: expect.arrayContaining([
-          { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-          { name: "ANTHROPIC_API_KEY", mode: "deny" },
-        ]),
+        envVars: [],
       },
     });
   });

hub/test/unit/provider-proxy.test.ts

@@ -52,9 +52,10 @@ describe("run-scoped provider proxy", () => {
     expect(serializedAgentEnv).not.toContain(String(address.port));
     expect(lease.sdkEnv).toMatchObject({
       ANTHROPIC_BASE_URL: expect.stringMatching(/^http:\/\/127\.0\.0\.1:\d+$/),
-      ANTHROPIC_AUTH_TOKEN: "",
+      ANTHROPIC_AUTH_TOKEN: expect.any(String),
       ANTHROPIC_API_KEY: expect.any(String),
     });
+    expect(lease.sdkEnv.ANTHROPIC_AUTH_TOKEN).toBe(lease.sdkEnv.ANTHROPIC_API_KEY);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
       method: "POST",
@@ -104,7 +105,11 @@ describe("run-scoped provider proxy", () => {
 
     expect(response.status).toBe(401);
     expect(upstreamRequests).toBe(0);
-    expect(diagnostics).toEqual([{ code: "provider_proxy_unauthorized", category: "authorization" }]);
+    expect(diagnostics).toEqual([{
+      code: "provider_proxy_unauthorized",
+      category: "authorization",
+      authShape: { bearerLength: 0, apiKeyLength: 0, expectedLength: 43 },
+    }]);
   });
 
   it("accepts the run capability in the Anthropic x-api-key header", async () => {

hub/test/unit/runner.test.ts

@@ -288,10 +288,7 @@ describe("runAgent", () => {
         },
         sandbox: {
           credentials: {
-            envVars: expect.arrayContaining([
-              { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-              { name: "ANTHROPIC_API_KEY", mode: "deny" },
-            ]),
+            envVars: [],
           },
         },
       },