schema = "m64/capsule@1"description = "opencode terminal on DeepSeek V4.1 Flash (OpenRouter). opencode 1.18.23's own TUI, running in tmux inside the sandbox and served to the browser by ttyd: open the app port and use opencode as in a terminal. The session survives closing the tab. Drives DeepSeek V4.1 Flash through OpenRouter. No GPU; the only egress is openrouter.ai:443, and the m64 gate adds the OpenRouter key, so the agent never holds it."# No API kind: the main port only carries /status, /agent, /human and /health; the# terminal is the app ([runtime.app]) on the second port.kinds = []authors = ["dh7"]license = "apache-2.0"[hardware]platform = "linux-aarch64"[runtime]sandbox = "container"# No image: the Dockerfile builds on node:22-bookworm-slim pinned by digest.gpu = false# A tiny health server (health.js); the front needs an internal port and a health route.internal_port = 9500health = "/health"expected_load_seconds = 60user = "1000:1000"# ttyd: the opencode TUI (tmux session "opencode") over HTTP + WebSocket (subprotocol# "tty"). Raw on the second front port, which carries the front's peer, Host, same-site,# WebSocket-Origin and token checks; ttyd itself has no auth.[runtime.app]internal_port = 7681[network]needs = ["openrouter.ai:443"]why = "the model runs on OpenRouter: your prompts and its replies go through openrouter.ai"[secrets]required = ["OPENROUTER_API_KEY"]# The key never enters the container: opencode calls http://openrouter.ai/api/v1 through# the gate, which adds the header and goes on over TLS. The capsule's env var holds only the# placeholder m64-injected:OPENROUTER_API_KEY.[[secrets.inject]]name = "OPENROUTER_API_KEY"host = "openrouter.ai"header = "Authorization"value = "Bearer {secret}"