acdev 1.0.5 → 1.0.7

package/src/models.js

@@ -15,8 +15,9 @@ import { join } from 'node:path';
 /**
  * Curated Claude Agent SDK / Claude Code model ids used as defaults + fallback.
  * Prefer documented Code aliases and Anthropic API ids (not invented snapshots).
+ * OpenRouter slugs (provider/model) are excluded — those belong in OPENROUTER_MODEL_OPTIONS.
  */
-export const MODEL_OPTIONS = [
+export const CLAUDE_MODEL_OPTIONS = [
   { id: 'claude-sonnet-5', label: 'Sonnet 5' },
   { id: 'claude-opus-5', label: 'Opus 5' },
   { id: 'claude-fable-5', label: 'Fable 5' },
@@ -38,22 +39,49 @@ export const MODEL_OPTIONS = [
   { id: 'claude-opus-4-5-20251101', label: 'Opus 4.5 (20251101)' },
 ];
 
+/** @deprecated Use CLAUDE_MODEL_OPTIONS */
+export const MODEL_OPTIONS = CLAUDE_MODEL_OPTIONS;
+
 export const DEFAULT_MODEL = 'claude-sonnet-5';
 
-/** Loose model id shape accepted by config (API ids + Claude Code aliases). */
-export const MODEL_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+/**
+ * OpenRouter slugs that work with acdev agent runs.
+ * Agent jobs use Claude Agent SDK via OpenRouter's Anthropic-compatible API;
+ * only anthropic/* models are supported on that path.
+ */
+export const OPENROUTER_AGENT_MODEL_PREFIX = 'anthropic/';
+
+/** Curated OpenRouter model ids used as defaults + fallback (agent-compatible only). */
+export const OPENROUTER_MODEL_OPTIONS = [
+  { id: 'anthropic/claude-sonnet-4', label: 'Claude Sonnet 4 (Anthropic)' },
+  { id: 'anthropic/claude-opus-4', label: 'Claude Opus 4 (Anthropic)' },
+  { id: 'anthropic/claude-3.5-sonnet', label: 'Claude 3.5 Sonnet (Anthropic)' },
+  { id: 'anthropic/claude-3.7-sonnet', label: 'Claude 3.7 Sonnet (Anthropic)' },
+];
+
+export const DEFAULT_OPENROUTER_MODEL = 'anthropic/claude-sonnet-4';
+
+/** Config value meaning no model selected (jobs blocked until user picks one). */
+export const NO_MODEL = '-';
+
+/** @typedef {'claude' | 'openrouter'} LlmProvider */
+export const LLM_PROVIDERS = /** @type {const} */ (['claude', 'openrouter']);
+
+/** Loose model id shape accepted by config (Claude aliases, API ids, OpenRouter slugs). */
+export const MODEL_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9._:\/-]{0,127}$/;
 
 const ANTHROPIC_MODELS_URL = 'https://api.anthropic.com/v1/models';
+const OPENROUTER_MODELS_URL = 'https://openrouter.ai/api/v1/models';
 const ANTHROPIC_VERSION = '2023-06-01';
 const CACHE_TTL_MS = 5 * 60_000;
 const KEYCHAIN_SERVICE = 'Claude Code-credentials';
 
 /** @typedef {{ id: string, name?: string, label?: string }} ModelOption */
-/** @typedef {'anthropic' | 'fallback'} ModelsSource */
-/** @typedef {{ models: ModelOption[], selected: string, source: ModelsSource }} ModelsListResult */
+/** @typedef {'anthropic' | 'openrouter' | 'fallback'} ModelsSource */
+/** @typedef {{ models: ModelOption[], selected: string, source: ModelsSource, provider?: LlmProvider }} ModelsListResult */
 
-/** @type {{ expiresAt: number, result: Omit<ModelsListResult, 'selected'> } | null} */
-let cache = null;
+/** @type {Map<LlmProvider, { expiresAt: number, result: Omit<ModelsListResult, 'selected' | 'provider'> }>} */
+const cacheByProvider = new Map();
 
 /** @type {typeof fetch | null} */
 let fetchImpl = null;
@@ -92,7 +120,23 @@ export function _resetCredentialsTokenResolver() {
 }
 
 export function _resetModelsCache() {
-  cache = null;
+  cacheByProvider.clear();
+}
+
+/**
+ * @param {unknown} value
+ * @returns {value is LlmProvider}
+ */
+export function isValidLlmProvider(value) {
+  return value === 'claude' || value === 'openrouter';
+}
+
+/**
+ * Default model id for an LLM provider.
+ * @param {LlmProvider} [provider]
+ */
+export function defaultModelForProvider(provider = 'claude') {
+  return provider === 'openrouter' ? DEFAULT_OPENROUTER_MODEL : DEFAULT_MODEL;
 }
 
 /**
@@ -103,6 +147,24 @@ export function isValidModelId(value) {
   return typeof value === 'string' && MODEL_ID_RE.test(value.trim());
 }
 
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isNoModel(value) {
+  if (value == null) return true;
+  const s = String(value).trim();
+  return s === '' || s === NO_MODEL;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isValidModelSelection(value) {
+  return isNoModel(value) || isValidModelId(value);
+}
+
 /**
  * @param {string} id
  * @param {string} [displayName]
@@ -114,7 +176,131 @@ function toOption(id, displayName) {
 }
 
 /**
- * Merge curated options (stable order / aliases) with live Anthropic rows.
+ * Claude direct path ids: Anthropic API ids and Claude Code aliases (no provider/ prefix).
+ * @param {string} id
+ * @returns {boolean}
+ */
+export function isClaudeCatalogId(id) {
+  return isValidModelId(id) && !String(id).includes('/');
+}
+
+/**
+ * OpenRouter slugs use provider/model form (always includes `/`).
+ * @param {string} id
+ * @returns {boolean}
+ */
+export function isOpenRouterCatalogId(id) {
+  return isValidModelId(id) && String(id).includes('/');
+}
+
+/**
+ * Whether an OpenRouter slug can be used for acdev agent runs.
+ * Non-anthropic slugs may appear in OpenRouter's catalog but fail at runtime
+ * because the Claude Agent SDK speaks Anthropic Messages API semantics.
+ * @param {string} modelId
+ * @returns {boolean}
+ */
+export function isOpenRouterAgentCompatibleModel(modelId) {
+  if (!isOpenRouterCatalogId(modelId)) return false;
+  return String(modelId).trim().toLowerCase().startsWith(OPENROUTER_AGENT_MODEL_PREFIX);
+}
+
+/**
+ * @param {ModelOption[]} models
+ * @returns {ModelOption[]}
+ */
+function filterOpenRouterAgentModels(models) {
+  return models.filter((m) => m?.id && isOpenRouterAgentCompatibleModel(m.id));
+}
+
+/**
+ * Improve OpenRouter agent failure messages for the job UI.
+ * @param {string} message
+ * @param {string} [model]
+ * @returns {string}
+ */
+export function enhanceOpenRouterAgentError(message, model) {
+  const raw = String(message || '').trim();
+  if (!raw) return raw;
+
+  const id = String(model || '').trim();
+  const routingFailure =
+    /no allowed providers are available/i.test(raw) ||
+    /not allowed by provider/i.test(raw) ||
+    /model.*not allowed/i.test(raw);
+
+  if (id && !isOpenRouterAgentCompatibleModel(id)) {
+    return [
+      `OpenRouter model "${id}" is not supported for acdev agent runs.`,
+      'Agent jobs use the Claude Agent SDK via OpenRouter\'s Anthropic-compatible API.',
+      'Choose an anthropic/* model (e.g. anthropic/claude-sonnet-4).',
+      raw !== id ? `Provider error: ${raw}` : '',
+    ]
+      .filter(Boolean)
+      .join(' ');
+  }
+
+  if (routingFailure) {
+    return [
+      raw,
+      'If you use OpenRouter provider allowlists, clear Settings → Privacy → Providers or add the model\'s upstream provider.',
+      'For acdev, anthropic/* models on OpenRouter are the most reliable choice.',
+    ].join(' ');
+  }
+
+  return raw;
+}
+
+/**
+ * Curated fallback list for a provider.
+ * @param {LlmProvider} provider
+ * @returns {ModelOption[]}
+ */
+export function curatedModelOptions(provider) {
+  return provider === 'openrouter'
+    ? OPENROUTER_MODEL_OPTIONS.map((m) => ({ ...m }))
+    : CLAUDE_MODEL_OPTIONS.map((m) => ({ ...m }));
+}
+
+/**
+ * Whether a model id belongs in a provider's curated catalog.
+ * @param {string} modelId
+ * @param {LlmProvider} provider
+ * @returns {boolean}
+ */
+export function isModelInCuratedCatalog(modelId, provider) {
+  if (isNoModel(modelId)) return false;
+  const id = String(modelId).trim();
+  return curatedModelOptions(provider).some((m) => m.id === id);
+}
+
+/**
+ * Whether a model id is valid for a provider (format-based, not curated-only).
+ * Claude: direct ids without `/`. OpenRouter: provider/model slugs with `/`.
+ * @param {string} modelId
+ * @param {LlmProvider} provider
+ * @returns {boolean}
+ */
+export function isModelIdForProvider(modelId, provider) {
+  if (isNoModel(modelId) || !isValidModelId(modelId)) return false;
+  const id = String(modelId).trim();
+  return provider === 'openrouter' ? isOpenRouterCatalogId(id) : isClaudeCatalogId(id);
+}
+
+/**
+ * Drop ids that do not belong in this provider's catalog.
+ * @param {ModelOption[]} models
+ * @param {LlmProvider} provider
+ * @returns {ModelOption[]}
+ */
+function filterModelsForProvider(models, provider) {
+  const keep =
+    provider === 'openrouter' ? isOpenRouterCatalogId : isClaudeCatalogId;
+  return models.filter((m) => m?.id && keep(m.id));
+}
+
+/**
+ * Merge curated options (stable order / aliases) with live rows for one provider.
  * Same ids keep curated position but prefer live display names.
  * @param {ModelOption[]} curated
  * @param {ModelOption[]} live
@@ -149,13 +335,16 @@ function mergeModelLists(curated, live) {
 }
 
 /**
+ * Keep selected only when it exists in the provider model catalog.
  * @param {ModelOption[]} models
  * @param {string} selected
- * @returns {ModelOption[]}
+ * @returns {string}
  */
-function ensureSelected(models, selected) {
-  if (!selected || models.some((m) => m.id === selected)) return models;
-  return [toOption(selected), ...models];
+export function reconcileModelForProvider(models, selected) {
+  if (isNoModel(selected)) return NO_MODEL;
+  const id = String(selected).trim();
+  if (!isValidModelId(id)) return NO_MODEL;
+  return models.some((m) => m.id === id) ? id : NO_MODEL;
 }
 
 /**
@@ -320,47 +509,115 @@ export async function fetchAnthropicModels() {
 }
 
 /**
- * List models for the UI.
- * @param {{ selected?: string, force?: boolean }} [opts]
+ * @param {Response} res
+ * @returns {Promise<ModelOption[]>}
+ */
+async function parseOpenRouterModelsResponse(res) {
+  if (!res.ok) {
+    throw new Error(`OpenRouter Models API HTTP ${res.status}`);
+  }
+  const body = await res.json();
+  const rows = Array.isArray(body?.data) ? body.data : [];
+  /** @type {ModelOption[]} */
+  const models = [];
+  for (const row of rows) {
+    const id = typeof row?.id === 'string' ? row.id.trim() : '';
+    if (!isValidModelId(id)) continue;
+    const display =
+      typeof row.name === 'string'
+        ? row.name
+        : typeof row?.id === 'string'
+          ? row.id
+          : '';
+    models.push(toOption(id, display));
+  }
+  if (models.length === 0) {
+    throw new Error('OpenRouter Models API returned no models');
+  }
+  return models;
+}
+
+/**
+ * Fetch live models from OpenRouter (no cache).
+ * @returns {Promise<ModelOption[]>}
+ */
+export async function fetchOpenRouterModels() {
+  const env = envResolver();
+  const apiKey = (env.OPENROUTER_API_KEY || '').trim();
+  if (!apiKey) {
+    throw new Error('No OpenRouter API key for models list');
+  }
+  const doFetch = fetchImpl || globalThis.fetch;
+  if (typeof doFetch !== 'function') {
+    throw new Error('fetch is not available');
+  }
+  const res = await doFetch(OPENROUTER_MODELS_URL, {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'HTTP-Referer': 'https://github.com/acdev',
+      'X-Title': 'acdev',
+    },
+  });
+  return parseOpenRouterModelsResponse(res);
+}
+
+/**
+ * @param {LlmProvider} provider
+ * @param {{ selected?: string, force?: boolean }} opts
  * @returns {Promise<ModelsListResult>}
  */
-export async function listModels(opts = {}) {
+async function listModelsForProvider(provider, opts = {}) {
   const selectedRaw = opts.selected;
-  const selected = isValidModelId(selectedRaw)
-    ? String(selectedRaw).trim()
-    : DEFAULT_MODEL;
   const force = opts.force === true;
   const now = Date.now();
+  const cache = cacheByProvider.get(provider);
 
   if (!force && cache && cache.expiresAt > now) {
+    const selected = reconcileModelForProvider(cache.result.models, selectedRaw);
     return {
       ...cache.result,
-      models: ensureSelected(cache.result.models, selected),
+      models: cache.result.models,
       selected,
+      provider,
     };
   }
 
+  const curated = curatedModelOptions(provider);
+
   try {
-    const live = await fetchAnthropicModels();
-    // Keep curated Claude Code aliases available alongside API ids.
-    const models = ensureSelected(
-      mergeModelLists(
-        MODEL_OPTIONS.map((m) => ({ ...m })),
-        live
-      ),
-      selected
-    );
-    const result = { models, source: /** @type {ModelsSource} */ ('anthropic') };
-    cache = { expiresAt: now + CACHE_TTL_MS, result };
-    return { ...result, selected };
+    const liveRaw =
+      provider === 'openrouter'
+        ? await fetchOpenRouterModels()
+        : await fetchAnthropicModels();
+    const live = filterModelsForProvider(liveRaw, provider);
+    let models = filterModelsForProvider(mergeModelLists(curated, live), provider);
+    if (provider === 'openrouter') {
+      models = filterOpenRouterAgentModels(models);
+    }
+    const selected = reconcileModelForProvider(models, selectedRaw);
+    const source = /** @type {ModelsSource} */ (provider === 'openrouter' ? 'openrouter' : 'anthropic');
+    const result = { models, source };
+    cacheByProvider.set(provider, { expiresAt: now + CACHE_TTL_MS, result });
+    return { ...result, selected, provider };
   } catch {
-    const models = ensureSelected(
-      MODEL_OPTIONS.map((m) => ({ ...m })),
-      selected
-    );
+    let models = curated;
+    if (provider === 'openrouter') {
+      models = filterOpenRouterAgentModels(models);
+    }
+    const selected = reconcileModelForProvider(models, selectedRaw);
     const result = { models, source: /** @type {ModelsSource} */ ('fallback') };
-    // Short cache on fallback so we retry Anthropic soon after auth is saved.
-    cache = { expiresAt: now + 30_000, result };
-    return { ...result, selected };
+    cacheByProvider.set(provider, { expiresAt: now + 30_000, result });
+    return { ...result, selected, provider };
   }
 }
+
+/**
+ * List models for the UI.
+ * @param {{ selected?: string, force?: boolean, provider?: LlmProvider }} [opts]
+ * @returns {Promise<ModelsListResult>}
+ */
+export async function listModels(opts = {}) {
+  const provider = isValidLlmProvider(opts.provider) ? opts.provider : 'claude';
+  return listModelsForProvider(provider, opts);
+}

package/src/openrouter-auth.js

@@ -0,0 +1,37 @@
+/** @typedef {{ ok: true } | { ok: false, reason: 'missing' }} OpenRouterAuthResult */
+
+/** @type {() => NodeJS.ProcessEnv} */
+let envResolver = () => process.env;
+
+/** @param {() => NodeJS.ProcessEnv} fn */
+export function _setEnvResolver(fn) {
+  envResolver = fn;
+}
+
+export function _resetEnvResolver() {
+  envResolver = () => process.env;
+}
+
+/**
+ * Whether OpenRouter can authenticate agent runs.
+ * @returns {OpenRouterAuthResult}
+ */
+export function checkOpenRouterAuth() {
+  const key = (envResolver().OPENROUTER_API_KEY || '').trim();
+  if (key) return { ok: true };
+  return { ok: false, reason: 'missing' };
+}
+
+/**
+ * Human-readable startup warning for a failed {@link checkOpenRouterAuth}.
+ * Soft-auth: server still starts so Settings can configure the key.
+ * @param {OpenRouterAuthResult} [_result]
+ */
+export function formatOpenRouterAuthError(_result) {
+  return [
+    '⚠ OpenRouter is not authenticated — server will still start.',
+    '  Open Settings → Authentication to add your OpenRouter API key',
+    '  (or set OPENROUTER_API_KEY in `.acdev/.env`).',
+    '  For UI-only testing without auth: pass `--stub-agent`.',
+  ].join('\n');
+}

package/src/server.js

@@ -38,6 +38,8 @@ import { splitIssueUrls } from './urls.js';
 import { usageFromLogs, withJobUsage } from './usage.js';
 import { checkGhAuth } from './gh-auth.js';
 import { checkClaudeAuth } from './claude-auth.js';
+import { checkOpenRouterAuth } from './openrouter-auth.js';
+import { isValidLlmProvider, isValidModelId, isNoModel, NO_MODEL, isOpenRouterAgentCompatibleModel, enhanceOpenRouterAgentError } from './models.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -173,6 +175,7 @@ export function normalizeReviewComments(body) {
  *     resolveJiraCredentials?: Function,
  *     checkGhAuth?: typeof checkGhAuth,
  *     checkClaudeAuth?: typeof checkClaudeAuth,
+ *     checkOpenRouterAuth?: typeof checkOpenRouterAuth,
  *   },
  * }} options
  */
@@ -188,15 +191,28 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
   const doApplyFileExclusions = deps.applyFileExclusions || applyFileExclusions;
   const doCheckGhAuth = deps.checkGhAuth || checkGhAuth;
   const doCheckClaudeAuth = deps.checkClaudeAuth || checkClaudeAuth;
+  const doCheckOpenRouterAuth = deps.checkOpenRouterAuth || checkOpenRouterAuth;
+
+  function currentLlmProvider() {
+    return isValidLlmProvider(config.llmProvider) ? config.llmProvider : 'claude';
+  }
+
+  function formatAgentJobError(err) {
+    let message = err instanceof Error ? err.message : String(err);
+    if (currentLlmProvider() === 'openrouter') {
+      message = enhanceOpenRouterAgentError(message, config.model);
+    }
+    return message;
+  }
 
   /**
    * Reject enqueue / agent / PR actions when required auth is missing.
-   * @param {{ needGh?: boolean, needClaude?: boolean }} [opts]
+   * @param {{ needGh?: boolean, needLlm?: boolean }} [opts]
    * @returns {{ status: number, error: string, code: string } | null}
    */
   function authGate(opts = {}) {
     const needGh = opts.needGh !== false;
-    const needClaude = opts.needClaude === true && !useStubAgent;
+    const needLlm = opts.needLlm !== false && !useStubAgent;
 
     if (needGh) {
       const gh = doCheckGhAuth();
@@ -209,16 +225,53 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       }
     }
 
-    if (needClaude) {
-      const claude = doCheckClaudeAuth();
-      if (!claude.ok) {
+    if (needLlm) {
+      const model = String(config.model ?? '').trim();
+      if (isNoModel(model)) {
         return {
           status: 400,
-          error:
-            'Claude is not authenticated. Add an API key or OAuth token in Settings → Authentication, run claude auth login, or start with --stub-agent.',
-          code: 'claude_auth_required',
+          error: `No model selected. Choose a model in Settings → Configuration (not "${NO_MODEL}") before starting jobs.`,
+          code: 'model_required',
+        };
+      }
+      if (!isValidModelId(model)) {
+        return {
+          status: 400,
+          error: 'Invalid model in configuration. Choose a valid model in Settings → Configuration.',
+          code: 'model_invalid',
         };
       }
+
+      const provider = currentLlmProvider();
+      if (provider === 'openrouter') {
+        const openrouter = doCheckOpenRouterAuth();
+        if (!openrouter.ok) {
+          return {
+            status: 400,
+            error:
+              'OpenRouter is not authenticated. Add an API key in Settings → Authentication, or start with --stub-agent.',
+            code: 'openrouter_auth_required',
+          };
+        }
+        if (!isOpenRouterAgentCompatibleModel(model)) {
+          return {
+            status: 400,
+            error:
+              `Model "${model}" is not supported for OpenRouter agent runs. acdev uses the Claude Agent SDK (Anthropic-compatible API). Choose an anthropic/* model such as anthropic/claude-sonnet-4.`,
+            code: 'openrouter_model_incompatible',
+          };
+        }
+      } else {
+        const claude = doCheckClaudeAuth();
+        if (!claude.ok) {
+          return {
+            status: 400,
+            error:
+              'Claude is not authenticated. Add an API key or OAuth token in Settings → Authentication, run claude auth login, or start with --stub-agent.',
+            code: 'claude_auth_required',
+          };
+        }
+      }
     }
 
     return null;
@@ -230,6 +283,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       stubAgent: useStubAgent,
       ghAuth: doCheckGhAuth(),
       claudeAuth: doCheckClaudeAuth(),
+      openrouterAuth: doCheckOpenRouterAuth(),
     });
   }
 
@@ -271,7 +325,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
     let job = store.getJob(jobId);
     if (!job) return;
 
-    const gate = authGate({ needGh: true, needClaude: true });
+    const gate = authGate({ needGh: true, needLlm: true });
     if (gate) {
       appendLog(job, 'error', gate.error);
       store.updateJob(jobId, { status: 'failed', error: gate.error });
@@ -383,7 +437,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       if (usage) patch.usage = usage;
       setStatus(jobId, 'awaiting_review', patch);
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
+      const message = formatAgentJobError(err);
       const current = store.getJob(jobId);
       if (!current) return;
       appendLog(current, 'error', message);
@@ -410,7 +464,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
     let job = store.getJob(jobId);
     if (!job || job.status !== 'applying_feedback') return;
 
-    const gate = authGate({ needGh: false, needClaude: true });
+    const gate = authGate({ needGh: false, needLlm: true });
     if (gate) {
       appendLog(job, 'error', gate.error);
       store.updateJob(jobId, {
@@ -484,7 +538,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       if (usage) patch.usage = usage;
       setStatus(jobId, 'awaiting_review', patch);
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
+      const message = formatAgentJobError(err);
       const current = store.getJob(jobId);
       if (!current) return;
       appendLog(current, 'error', message);
@@ -549,7 +603,11 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
         req.query.refresh === '1' ||
         req.query.refresh === 'true' ||
         req.query.force === '1';
-      const result = await listModels({ selected: config.model, force });
+      const provider =
+        req.query.provider === 'openrouter' || req.query.provider === 'claude'
+          ? req.query.provider
+          : currentLlmProvider();
+      const result = await listModels({ selected: config.model, force, provider });
       res.json(result);
     } catch (err) {
       res.status(500).json({ error: err.message });
@@ -573,6 +631,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       applySecretField(envPatch, 'GH_TOKEN', patch.ghToken);
       applySecretField(envPatch, 'ANTHROPIC_API_KEY', patch.anthropicApiKey);
       applySecretField(envPatch, 'CLAUDE_CODE_OAUTH_TOKEN', patch.claudeOauthToken);
+      applySecretField(envPatch, 'OPENROUTER_API_KEY', patch.openrouterApiKey);
       if (patch.jiraBaseUrl !== undefined && typeof patch.jiraBaseUrl === 'string') {
         // Also mirror base URL into env for convenience when set via Settings
         const trimmed = patch.jiraBaseUrl.trim();
@@ -590,6 +649,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
         ghToken: _gh,
         anthropicApiKey: _ak,
         claudeOauthToken: _oa,
+        openrouterApiKey: _or,
         ...configPatch
       } = patch;
       updateConfig(repoRoot, config, configPatch);
@@ -623,7 +683,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
 
   app.post('/api/issues', (req, res) => {
     try {
-      const gate = authGate({ needGh: true, needClaude: true });
+      const gate = authGate({ needGh: true, needLlm: true });
       if (gate) {
         return res.status(gate.status).json({ error: gate.error, code: gate.code });
       }
@@ -803,7 +863,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
 
   app.post('/api/jobs/:id/review', (req, res) => {
     try {
-      const gate = authGate({ needGh: false, needClaude: true });
+      const gate = authGate({ needGh: false, needLlm: true });
       if (gate) {
         return res.status(gate.status).json({ error: gate.error, code: gate.code });
       }
@@ -853,7 +913,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
 
   app.post('/api/jobs/:id/approve', async (req, res) => {
     try {
-      const gate = authGate({ needGh: true, needClaude: false });
+      const gate = authGate({ needGh: true, needLlm: false });
       if (gate) {
         return res.status(gate.status).json({ error: gate.error, code: gate.code });
       }
@@ -1036,7 +1096,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
 
   app.post('/api/jobs/:id/retry', (req, res) => {
     try {
-      const gate = authGate({ needGh: true, needClaude: true });
+      const gate = authGate({ needGh: true, needLlm: true });
       if (gate) {
         return res.status(gate.status).json({ error: gate.error, code: gate.code });
       }