README.md:243 advertises the opencode harness as "anything on models.dev — Fireworks, Groq, OpenRouter, …", but the credential handed to the child process is chosen per harness, not per model.
providerEnvFor('opencode') is hard-wired to FIREWORKS_API_KEY (src/config.ts:40-47), and runner.ts:282 builds the child env from it. Setting secret: JUROR_OPENROUTER_API_KEY only changes which variable Juror reads — the key still reaches opencode named FIREWORKS_API_KEY, so an openrouter/... or groq/... model fails to authenticate with no visible auth error.
The documented escape hatch doesn't help either: envPassthrough explicitly strips any name matching API_KEY (src/harness/runner.ts:213-223).
Suggested scope
- Add an optional
provider_env to ModelConfig (src/types.ts:400-416).
- Accept it in
MODEL_KEYS / coerceModel (src/config.ts:466-542).
- Prefer it at
runner.ts:282. Add a config test.
A docs-only correction of the README claim is an acceptable smaller alternative — say which you're doing.
README.md:243advertises the opencode harness as "anything on models.dev — Fireworks, Groq, OpenRouter, …", but the credential handed to the child process is chosen per harness, not per model.providerEnvFor('opencode')is hard-wired toFIREWORKS_API_KEY(src/config.ts:40-47), andrunner.ts:282builds the child env from it. Settingsecret: JUROR_OPENROUTER_API_KEYonly changes which variable Juror reads — the key still reaches opencode namedFIREWORKS_API_KEY, so anopenrouter/...orgroq/...model fails to authenticate with no visible auth error.The documented escape hatch doesn't help either:
envPassthroughexplicitly strips any name matchingAPI_KEY(src/harness/runner.ts:213-223).Suggested scope
provider_envtoModelConfig(src/types.ts:400-416).MODEL_KEYS/coerceModel(src/config.ts:466-542).runner.ts:282. Add a config test.A docs-only correction of the README claim is an acceptable smaller alternative — say which you're doing.