# OpenCode on CT 116 (Submatter)

Headless coding harness for Submatter. Prefer this over OpenHands.

Runs `opencode serve` on `:4096` (HTTP API for the worker). Attach a TUI with
`opencode attach http://…:4096`, or use the browser via Traefik once Authentik
is happy. The image has no desktop browser — do not use `opencode web` in
compose without an `xdg-open` stub (entrypoint provides one if you switch back).

## Enable

On CT 116 `/opt/submatter/.env`:

```bash
COMPOSE_PROFILES=opencode
WORKER_SESSION_TYPE=opencode          # after worker image rebuild with opencode session
OPENCODE_SERVER_PASSWORD=<openssl rand -hex 24>
OPENCODE_SERVER_URL=http://opencode:4096
OMNIROUTE_BASE_URL=https://omniroute.stillwell.cloud/v1
OMNIROUTE_API_KEY=<gateway inference key>
```

Then:

```bash
export COMPOSE_PROFILES=opencode
bash scripts/deploy-prod.sh up
# First time / after worker harness code lands:
# bash scripts/deploy-prod.sh build
```

Keep `WORKER_SESSION_TYPE=minimal` until the rebuilt worker image includes the
`opencode` session type (and the `yaml` dependency fix).

## URLs

| Surface | URL |
|---------|-----|
| Traefik | `https://opencode.stillwell.cloud` (Authentik + basic auth) |
| Worker API | `http://opencode:4096` on the `echodo` Docker network |
| LAN health | `curl -u opencode:$OPENCODE_SERVER_PASSWORD http://192.168.68.116:4096/global/health` |

## Auth

- Browser: Authentik via Traefik (`authentik-auth`) **and** OpenCode basic auth.
- Worker: same basic auth via `OPENCODE_SERVER_PASSWORD`.
- Models: `@omniroute/opencode-plugin` + `OMNIROUTE_API_KEY` (seeded into `auth.json` by `entrypoint.sh`).

## RAM

Container capped at 2 GB. Keep one concurrent agent until host RAM → 64 GB.