fix: set litellm key as OPENAI_API_KEY env var, not in config file

container/entrypoint.py

@@ -86,13 +86,16 @@ def fetch_role_secrets(bao_token: str, role: str) -> dict:
 
 
 def write_opencode_config(secrets: dict, role: str) -> None:
-    """Write opencode config with the agent's secrets and MCP server tokens."""
+    """Write opencode config and set secrets as env vars for opencode to pick up."""
     CONFIG_DIR.mkdir(parents=True, exist_ok=True)
 
-    litellm_key = secrets.get("litellm-key", "")
     vikunja_token = secrets.get("vikunja-token", "")
     forgejo_token = secrets.get("forgejo-token", "")
 
+    # Set the LiteLLM API key as env var — opencode reads OPENAI_API_KEY for
+    # openai-compatible providers, or the provider-specific env var
+    os.environ["OPENAI_API_KEY"] = secrets.get("litellm-key", "")
+
     config = {
         "$schema": "https://opencode.ai/config.json",
         "model": "litellm/copilot/claude-sonnet-4.6",
@@ -102,7 +105,6 @@ def write_opencode_config(secrets: dict, role: str) -> None:
                 "name": "LiteLLM",
                 "options": {
                     "baseURL": f"{LITELLM_BASE_URL}/v1",
-                    "apiKey": litellm_key,
                 }
             }
         },