schema = "m64/capsule@1"
description = "opencode agent on DeepSeek V4.1 Flash (OpenRouter). opencode 1.18.23 coding agent driving DeepSeek V4.1 Flash through OpenRouter. Each session gets an empty directory; the agent can write and run code there. No GPU; the only egress is openrouter.ai:443, and the m64 gate adds the OpenRouter key, so the agent never holds it."
kinds = ["agent.session"]
authors = ["dh7"]
license = "apache-2.0"

[hardware]
platform = "linux-aarch64"

[runtime]
sandbox = "container"
# No image: the Dockerfile builds on node:22-bookworm-slim pinned by digest.
gpu = false
internal_port = 9500
health = "/health"
expected_load_seconds = 60
user = "1000:1000"

# opencode's own server (web UI + full API, SSE and the terminal's WebSocket) on a second
# front port. Raw: no per-session isolation and no params filtering there.
[runtime.app]
internal_port = 4096

[network]
needs = ["openrouter.ai:443"]
why = "the model runs on OpenRouter: your prompts and its replies go through openrouter.ai"

[secrets]
required = ["OPENROUTER_API_KEY"]

# The key never enters the container: opencode calls http://openrouter.ai/api/v1 through
# the gate, which adds the header and goes on over TLS. The capsule's env var holds only the
# placeholder m64-injected:OPENROUTER_API_KEY.
[[secrets.inject]]
name = "OPENROUTER_API_KEY"
host = "openrouter.ai"
header = "Authorization"
value = "Bearer {secret}"