schema = "m64/capsule@1"description = "opencode agent on DeepSeek V4.1 Flash (OpenRouter). opencode 1.18.23 coding agent driving DeepSeek V4.1 Flash through OpenRouter. Each session gets an empty directory; the agent can write and run code there. No GPU; the only egress is openrouter.ai:443, and the m64 gate adds the OpenRouter key, so the agent never holds it."kinds = ["agent.session"]authors = ["dh7"]license = "apache-2.0"[hardware]platform = "linux-aarch64"[runtime]sandbox = "container"# No image: the Dockerfile builds on node:22-bookworm-slim pinned by digest.gpu = falseinternal_port = 9500health = "/health"expected_load_seconds = 60user = "1000:1000"# opencode's own server (web UI + full API, SSE and the terminal's WebSocket) on a second# front port. Raw: no per-session isolation and no params filtering there.[runtime.app]internal_port = 4096[network]needs = ["openrouter.ai:443"]why = "the model runs on OpenRouter: your prompts and its replies go through openrouter.ai"[secrets]required = ["OPENROUTER_API_KEY"]# The key never enters the container: opencode calls http://openrouter.ai/api/v1 through# the gate, which adds the header and goes on over TLS. The capsule's env var holds only the# placeholder m64-injected:OPENROUTER_API_KEY.[[secrets.inject]]name = "OPENROUTER_API_KEY"host = "openrouter.ai"header = "Authorization"value = "Bearer {secret}"