docs: rename DEEPSEEK_API_KEY → LLM_API_KEY in CLAUDE.md + quickstart + composite-action-spec #141

Background

PR #140 (pipeline-fix, merged 2026-07-13) renamed the engine secret DEEPSEEK_API_KEY → LLM_API_KEY across all 6 cloud workflows + 4 composite actions + docs/security.md. That PR was scoped to S7's allowed paths (.github/workflows/ + .github/actions/ + docs/security.md).

Several doc files + runtime scripts outside S7 scope still reference the old name. They need to go through the normal Issue→PR flow (dogfooding rule S7).

2026-07-18 scope expansion #1 — original issue only listed 4 doc files. AC #1 was already repo-wide ("no remaining DEEPSEEK_API_KEY references in repo except git history"), so the file list is expanded to include the runtime scripts Claude flagged during verify retry.

2026-07-18 scope expansion #2 — Module 6 (test) correctly identified that AC1/AC2/AC3 have ZERO automated coverage. A grep-guard test is required so the AC invariants become machine-verifiable on every future change.

Files + lines to update

CLAUDE.md

• L106: API keys per engine: ANTHROPIC_API_KEY, OPENAI_API_KEY — scoped per-job, never workflow-global (S3).
• Update to reflect LLM_API_KEY as the active provider-neutral secret name.

docs/quickstart-triage.md

• L45, L58, L99, L101 — still describe DeepSeek as the default provider.
• Rewrite to reflect GLM (open.bigmodel.cn/api/anthropic, model glm-5.2) as default, with LLM_API_KEY as the secret name.

docs/quickstart-clarify.md

• L70, L90, L213, L216 — same DeepSeek-centric framing.
• Same rewrite as triage quickstart.

docs/composite-action-spec.md

• L106: api-key (DEEPSEEK_API_KEY for GLM passthrough)
• L125: api-key (ANTHROPIC_API_KEY or GLM passthrough equivalent)
• L156: api-key (DEEPSEEK_API_KEY for GLM passthrough)
• L249: api-key: ${{ secrets.OPENAI_API_KEY }} # was ANTHROPIC_API_KEY
• Normalize to LLM_API_KEY across the spec table.

scripts/setup/lib/steps/03-llm-provider.mjs

• L23, L55 — still reference DEEPSEEK_API_KEY and DeepSeek defaults.
• Rename to LLM_API_KEY everywhere. The wizard should create the LLM_API_KEY secret (provider-neutral), not engine-specific names. GLM preset should use LLM_API_KEY, not ZHIPU_API_KEY.

scripts/setup/lib/steps/06-repo-vars.mjs

• L75 — stale deepseek-v4-pro / api.deepseek.com defaults.
• Replace with GLM defaults (glm-5.2, open.bigmodel.cn/api/anthropic).

scripts/setup/README.md

• L41 — "DeepSeek passthrough" framing.
• Rewrite to describe GLM passthrough as the default path with LLM_API_KEY.

scripts/test/e2e-full.sh

• L176 — DEEPSEEK_API_KEY reference.
• L180-183 — stale deepseek-v4-pro / api.deepseek.com defaults.
• Rename to LLM_API_KEY and update defaults to GLM.

scripts/setup/test/rename-guard.test.mjs (NEW)

• New grep-guard test using Node node:test (no extra deps) — same runner as scripts/setup/package.json.
• Must assert:
  1. AC1: walking the repo from root (excluding .git/, node_modules/, .next/, .omc/), no plain-text file contains the literal string DEEPSEEK_API_KEY.
  2. AC2: scripts/ directory contains no occurrences of deepseek-v4-pro or api.deepseek.com.
  3. AC3: import PRESETS from ../lib/steps/03-llm-provider.mjs and assert PRESETS.glm.keyEnv === 'LLM_API_KEY' and PRESETS.glm.model === 'glm-5.2' and PRESETS.glm.baseUrl === 'https://open.bigmodel.cn/api/anthropic'.
  4. AC3 continued: there is NO preset whose keyEnv === 'ZHIPU_API_KEY'.
• Test must run under node --test without npm install (pure fs/grep + dynamic import). Do not import @inquirer/prompts.
• Add the new file to scripts/setup/package.json test glob if needed (current glob is 'test/**/*.test.mjs' — should already cover it).

Acceptance criteria

• All listed files updated; no remaining DEEPSEEK_API_KEY references in repo except git history (enforced by rename-guard.test.mjs AC1).
• No remaining deepseek-v4-pro or api.deepseek.com defaults in scripts/ (enforced by rename-guard.test.mjs AC2).
• Wizard GLM preset uses LLM_API_KEY (not ZHIPU_API_KEY) (enforced by rename-guard.test.mjs AC3).
• Quickstart walkthroughs reflect GLM passthrough as the default path (not DeepSeek).
• CLAUDE.md L106 reflects the active secret name.
• PR goes through normal Issue→PR pipeline (no pipeline-fix label — out of S7 scope).
• rename-guard.test.mjs passes on the PR branch with all 4 sub-assertions.
• Smoke check: open a fresh test Issue after merge, confirm triage still returns decision (regression guard for the rename, even though docs/wizard don't affect cloud pipeline runtime).

Context / non-goals

• Do NOT touch .github/workflows/ or .github/actions/ in this PR — those were handled in PR pipeline-fix: rename DEEPSEEK_API_KEY → LLM_API_KEY + job-level ANTHROPIC_BASE_URL + drop test-glm-key #140.
• Do NOT update docs/security.md again — it was already updated in PR pipeline-fix: rename DEEPSEEK_API_KEY → LLM_API_KEY + job-level ANTHROPIC_BASE_URL + drop test-glm-key #140.
• scripts/setup/ is now IN scope (added 2026-07-18): the wizard creates the secret name, so it must align with the cloud pipeline's LLM_API_KEY.
• docs/architecture.md:122 historical design note ("DeepSeek was considered... rejected") is intentional history — leave it. rename-guard.test.mjs must scope its grep to exclude docs/architecture.md (or only assert against non-markdown source/scripts paths).
• The DeepSeek references are historical (the project originally targeted DeepSeek's Anthropic-compatible endpoint before switching to GLM). The rename makes docs + wizard + tests consistent with the current GLM passthrough setup.