the credential comes from the environment

This script carried its key as a literal. A key in a source file is a key in
every clone of that file, and this repo mirrors publicly, so the value must be
rotated independently of this change — removing it from the tip does not remove
it from history.

Reads OPENROUTER_API_KEY and exits with a clear message when it is unset.

pkg/hanzo-mcp/tests/test_agent/openai_api_check.py

@@ -4,8 +4,13 @@ import sys
 
 from openai import OpenAI
 
-# Use the same API key from the script
-api_key = "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"
+import os
+
+# The credential is read from the environment. A key in a source file is a key
+# in every clone of it.
+api_key = os.environ.get("OPENROUTER_API_KEY")
+if not api_key:
+    sys.exit("set OPENROUTER_API_KEY")
 
 
 def check_api_connection():

pkg/hanzo/src/hanzo/commands/chat.py

@@ -109,8 +109,8 @@ async def ask_once(
                 console.print(
                     "[yellow]No local AI server running.[/yellow]\n"
                     "Start one of:\n"
-                    "  • The cloud: hanzo up\n"
-                    "  • One model: hanzo engine serve <model>"
+                    "  • Hanzo router: hanzo router start\n"
+                    "  • Local node: hanzo serve"
                 )
                 return