bin/: add 1Password CLI (op) and opencode

op is shipped as a zip rather than a tarball, so lib/fetch.sh grows an
install_zip_bin helper (unzip, falling back to python3's zipfile so
neither is a hard dependency).

Credentials for both stay per-box and out of this repo: op signs in via
`op signin` or OP_SERVICE_ACCOUNT_TOKEN, and opencode reaches the
covert-gpt gateway with the key that mcp-config/ syncs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -127,6 +127,35 @@ install_tofu() {
   mark_version tofu "$ver"
 }
 
+# op — 1Password CLI, used for secrets storage/retrieval (op read, op run,
+# op inject). Single static binary shipped as a zip. Sign in with
+# `op signin` or a service-account token (OP_SERVICE_ACCOUNT_TOKEN) —
+# credentials are per-box and never live in this repo.
+install_1p() {
+  ver=2.34.1
+  have_version op "$ver" && { fsay "op $ver already installed."; return 0; }
+  install_zip_bin \
+    "https://cache.agilebits.com/dist/1P/op2/pkg/v$ver/op_linux_${DEB}_v$ver.zip" \
+    op op
+  mark_version op "$ver"
+}
+
+# opencode — terminal AI coding agent. Points at the covert-gpt LiteLLM
+# gateway via mcp-config/opencode.gateway.json (synced by mcp-config/).
+# Release assets use x64/arm64 tokens rather than amd64/x86_64.
+install_opencode() {
+  ver=v1.17.18
+  have_version opencode "$ver" && { fsay "opencode $ver already installed."; return 0; }
+  case "$DEB" in
+    amd64) _oc_arch=x64 ;;
+    *) _oc_arch=arm64 ;;
+  esac
+  install_tarball_bin \
+    "https://github.com/sst/opencode/releases/download/$ver/opencode-linux-$_oc_arch.tar.gz" \
+    opencode opencode
+  mark_version opencode "$ver"
+}
+
 # task — go-task, the Taskfile.yml task runner. Binary is at the archive root.
 install_task() {
   ver=v3.52.0
@@ -163,5 +192,7 @@ install_yq
 install_tofu
 install_task
 install_terragrunt
+install_1p
+install_opencode
 
 fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."

lib/fetch.sh

@@ -73,6 +73,26 @@ install_tarball_bin() {
   fsay "installed $BIN_DIR/$3"
 }
 
+# install_zip_bin <url> <path-within-archive> <dest-name> — like
+# install_tarball_bin but for .zip assets (e.g. 1Password CLI). Uses unzip
+# when present, else python3's zipfile module, so no hard dependency on
+# either being installed.
+install_zip_bin() {
+  mkdir -p "$BIN_DIR"
+  _tmp="$(mktemp -d)"
+  _fetch_dl "$1" "$_tmp/archive.zip"
+  if command -v unzip >/dev/null 2>&1; then
+    unzip -q "$_tmp/archive.zip" -d "$_tmp"
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 -m zipfile -e "$_tmp/archive.zip" "$_tmp"
+  else
+    fsay "fetch: need unzip or python3 to extract zip"; rm -rf "$_tmp"; return 1
+  fi
+  install -m 0755 "$_tmp/$2" "$BIN_DIR/$3"
+  rm -rf "$_tmp"
+  fsay "installed $BIN_DIR/$3"
+}
+
 # install_raw_bin <url> <dest-name> — download a single raw binary.
 install_raw_bin() {
   mkdir -p "$BIN_DIR"