# opencode-tmux-dsflash-openrouter-gb10

opencode 1.18.23's own terminal UI, running in a tmux session inside the sandbox and
served to the browser by ttyd 1.7.7 (xterm.js over a WebSocket). Model: DeepSeek V4.1
Flash on OpenRouter. No GPU. The container's only egress is `openrouter.ai:443`, through
the m64 gate, which adds the OpenRouter key: the container never holds it.

This capsule is for a human at a browser. It has no API kind: there is nothing for an agent
to call besides status. An agent that wants to drive opencode programmatically should use
`opencode-dsflash-openrouter-gb10` (sessions API + `opencode attach`); one that wants only
the model should use `deepseek-flash-openrouter-gb10` (OpenAI chat completions).

## Ports and routes

Main port (the capsule's URL):

| Method | Path | What |
| --- | --- | --- |
| GET | `/status` | phase, and `app_url`: the terminal |
| GET | `/agent` | this document plus live status (`?format=json`: with `app_url`) |
| GET | `/human/` | landing page linking to the terminal |
| GET | `/health` | 200 once ttyd answers |

App port (`app_url`, the front's port + 1 unless `--app-port`): ttyd, raw.

- `GET /` is ttyd's page; `GET /token` its (empty) auth token; `GET /ws` the WebSocket,
  subprotocol `tty`. ttyd's protocol: the client first sends a JSON text frame
  `{"AuthToken":"","columns":C,"rows":R}`; then binary frames, first byte the command:
  client `0`+bytes = input, `1`+JSON `{"columns":C,"rows":R}` = resize; server `0`+bytes =
  output, `1` = window title, `2` = preferences.
- Every client attaches to the tmux session `opencode` (`tmux new-session -A`), so all tabs
  share one opencode, and it survives disconnects. If opencode is quit, the next client
  starts a new one. The workspace is `/scratch/work` (the run's scratch).

## Security

- ttyd runs without its own auth and without `--check-origin`. The app front gives this
  port exactly the main front's protections: tailnet peers only, a Host allowlist (DNS
  rebinding), same-site/CSRF refusal, the token rule, and a 403 for any WebSocket upgrade
  whose `Origin` is present and not the app's own origin (tested: a foreign Origin, or the
  main port's origin, gets 403; a fake Host gets 400 on HTTP and 403 on the upgrade).
- ttyd's own `--check-origin` is left off on purpose. The front forwards Host and Origin
  verbatim, so behind it ttyd's check would pass for a browser on the right origin, but it
  adds nothing the front does not already enforce, and it drops every upgrade that carries
  no Origin at all (non-browser clients such as scripts and tests).
- On the tailnet (the default) there is no token: anyone on your tailnet can open the
  terminal, i.e. run any command opencode or a shell can run in this container, and spend
  the OpenRouter key. With a token, open `app_url?token=<token>` once (it becomes a cookie).