opencode: use Juspay config via upstream home module

Consume juspay/AI's homeModules.opencode (config only, not the package) on
both zest and pureintent, install the opencode binary from nixpkgs, and
export JUSPAY_API_KEY from the agenix secret into interactive shells.

configurations/home/srid@zest.nix

@@ -13,6 +13,7 @@ in
     "${homeMod}/claude-code"
 
     "${homeMod}/work/juspay.nix"
+    "${homeMod}/work/opencode.nix"
 
     "${homeMod}/services/obsidian.nix"
     "${homeMod}/services/kolu.nix"

configurations/nixos/pureintent/default.nix

@@ -48,6 +48,7 @@ in
     "${homeMod}/cli/controlpersist.nix"
     "${homeMod}/claude-code"
     "${homeMod}/work/juspay.nix"
+    "${homeMod}/work/opencode.nix"
     "${homeMod}/services/vira.nix"
     "${homeMod}/services/kolu.nix"
     "${homeMod}/services/drishti"

flake.lock

@@ -835,6 +835,29 @@
         "type": "github"
       }
     },
+    "juspay-ai": {
+      "inputs": {
+        "llm-agents": [
+          "llm-agents"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782075422,
+        "narHash": "sha256-VVgVpxWFruch4X0PTfesyXVeppsSyBQFja+QIAuCQLo=",
+        "owner": "juspay",
+        "repo": "AI",
+        "rev": "c24b8d17ee80a8d03ef589eec0e68cd157e4ae9b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "juspay",
+        "repo": "AI",
+        "type": "github"
+      }
+    },
     "kolu": {
       "locked": {
         "lastModified": 1782072610,
@@ -1263,6 +1286,7 @@
         "home-manager": "home-manager",
         "imako": "imako",
         "jumphost-nix": "jumphost-nix",
+        "juspay-ai": "juspay-ai",
         "kolu": "kolu",
         "landrun-nix": "landrun-nix",
         "llm-agents": "llm-agents",

flake.nix

@@ -40,6 +40,12 @@
     # drishti remote host monitor (home-manager module)
     drishti.url = "github:srid/drishti";
 
+    # Juspay's AI tooling repo. We consume only its opencode home-manager
+    # module (config only, not the package) via homeModules.opencode.
+    juspay-ai.url = "github:juspay/AI";
+    juspay-ai.inputs.nixpkgs.follows = "nixpkgs";
+    juspay-ai.inputs.llm-agents.follows = "llm-agents";
+
     # anywhen is NOT a flake input — it's deployed as an incus-pet
     # container, with the flake ref passed at deploy time (see
     # `just pureintent anywhen-deploy`). The host config doesn't import

modules/home/work/opencode.nix

@@ -0,0 +1,35 @@
+# Juspay's opencode *configuration* (not the package), via the home-manager
+# module exposed upstream by juspay/AI (homeModules.opencode).
+#
+# The config points opencode at Juspay's LLM gateway and authenticates with
+# JUSPAY_API_KEY, which we source from the agenix-managed secret and export
+# into interactive shells below.
+
+{ flake, pkgs, config, ... }:
+let
+  homeMod = flake.inputs.self + /modules/home;
+in
+{
+  imports = [
+    flake.inputs.juspay-ai.homeModules.opencode
+    "${homeMod}/agenix.nix"
+  ];
+
+  programs.opencode-juspay.enable = true;
+
+  # The upstream module is config-only by design; install the binary from
+  # nixpkgs so the Juspay config above is usable out of the box.
+  home.packages = [ pkgs.opencode ];
+
+  # The Juspay litellm provider authenticates with JUSPAY_API_KEY at runtime.
+  # Decrypt the secret via agenix and export it into interactive shells.
+  age.secrets.juspay-anthropic-api-key.file =
+    flake.inputs.self + /secrets/juspay-anthropic-api-key.age;
+
+  programs.zsh.initContent = ''
+    export JUSPAY_API_KEY="$(cat "${config.age.secrets.juspay-anthropic-api-key.path}")"
+  '';
+  programs.bash.initExtra = ''
+    export JUSPAY_API_KEY="$(cat "${config.age.secrets.juspay-anthropic-api-key.path}")"
+  '';
+}