opencode rejected the config with "Unrecognized key: providers". The
file had both `provider` (opencode's schema: npm + options) and
`providers` (package: "aisdk:..." + settings, some other tool's shape,
left behind by an api-for-cursor script back in July). The Alibaba/Qwen
provider lived only under the rejected key, so it had never actually
reached opencode.
Translate it into the real schema -- package -> npm, settings -> options
at both provider and model level -- rather than dropping it, so those
five qwen models now work. The duplicate cursorapi under `providers` is
dropped: the existing provider.cursorapi is a superset, with four models
plus cost and limit metadata.
The 113-char bailian key moves to secrets/bailian-api-key (0600) and is
referenced as {file:./secrets/bailian-api-key}, which opencode resolves
relative to the config dir -- so no absolute home path, and no shell
export needed on ssh-only boxes. Verified by pointing it at a missing
file and getting "bad file reference".
With the key out, opencode.json can finally be tracked. Ignore the
secrets dir, the stale .bak copies that still contain it, and the
node/bun lockfiles.
2ba14d3e6d