feat: add OpenCode as ACP agent backend

OpenCode ships native ACP support via `opencode acp` — pure stdio
JSON-RPC, zero adapter layer required. Integration is configuration-only:
no changes to src/.

- config.toml.example: add commented opencode [agent] block
- Dockerfile.opencode: multi-stage build using debian:bookworm-slim +
  official install script (not node:22 — opencode is a self-contained
  binary; npm package is only a 9 KB download wrapper)
- README.md: add opencode to description, features, backend table, and
  Manual config section

Verified against opencode v1.4.3 on openab v0.7.1. Multi-turn
conversations stable end-to-end via Discord.

Author: wangyuyan-agent

Cargo.lock

@@ -0,0 +1,57 @@
+# --- Build stage ---
+FROM rust:1-bookworm AS builder
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir src && echo 'fn main() {}' > src/main.rs && cargo build --release && rm -rf src
+COPY src/ src/
+RUN touch src/main.rs && cargo build --release
+
+# --- Runtime stage ---
+# debian:bookworm-slim (not node:22) — opencode ships as a self-contained binary.
+# The npm package (opencode-ai) is only a 9 KB postinstall wrapper that downloads
+# the same pre-compiled binary; using node:22 as base just to run that wrapper
+# adds ~170 MB for a runtime that opencode itself never needs.
+# We use the official install script instead: curl -fsSL https://opencode.ai/install | bash
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl bash \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install gh CLI (matches Dockerfile.claude / Dockerfile.gemini / Dockerfile.codex)
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      -o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+      > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && apt-get install -y --no-install-recommends gh && \
+    rm -rf /var/lib/apt/lists/*
+
+# Create non-root user (mirrors USER node pattern in other Dockerfiles)
+RUN useradd -m -s /bin/bash opencode
+
+# Install opencode as the opencode user so $HOME resolves correctly.
+# The install script places the binary at $HOME/.opencode/bin/opencode;
+# we expose it on PATH via ENV so openab can spawn it without a shell login.
+#
+# Version is pinned for reproducible builds (mirrors the pinned-version
+# pattern in Dockerfile.codex and Dockerfile.claude).
+# opencode releases very frequently (often daily); bump this version via
+# a dedicated PR when a new release is needed.
+#
+# Note: opencode does not publish SHA256 checksums for its releases,
+# so checksum verification is not possible at this time.
+USER opencode
+ENV HOME=/home/opencode
+RUN curl -fsSL https://opencode.ai/install | bash -s -- --version 1.4.3
+ENV PATH="/home/opencode/.opencode/bin:$PATH"
+
+USER root
+WORKDIR /home/opencode
+
+COPY --from=builder --chown=opencode:opencode /build/target/release/openab /usr/local/bin/openab
+
+USER opencode
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD pgrep -x openab || exit 1
+ENTRYPOINT ["openab"]
+CMD ["/etc/openab/config.toml"]

Dockerfile.opencode

@@ -1,6 +1,6 @@
 # OpenAB — Open Agent Broker
 
-A lightweight, secure, cloud-native ACP harness that bridges Discord and any [Agent Client Protocol](https://github.com/anthropics/agent-protocol)-compatible coding CLI (Kiro CLI, Claude Code, Codex, Gemini, etc.) over stdio JSON-RPC — delivering the next-generation development experience.
+A lightweight, secure, cloud-native ACP harness that bridges Discord and any [Agent Client Protocol](https://github.com/anthropics/agent-protocol)-compatible coding CLI (Kiro CLI, Claude Code, Codex, Gemini, OpenCode, etc.) over stdio JSON-RPC — delivering the next-generation development experience.
 
 🪼 **Join our community!** Come say hi on Discord — we'd love to have you: **[🪼 OpenAB — Official](https://discord.gg/YNksK9M6)** 🎉
 
@@ -17,7 +17,7 @@ A lightweight, secure, cloud-native ACP harness that bridges Discord and any [Ag
 
 ## Features
 
-- **Pluggable agent backend** — swap between Kiro CLI, Claude Code, Codex, Gemini via config
+- **Pluggable agent backend** — swap between Kiro CLI, Claude Code, Codex, Gemini, OpenCode via config
 - **@mention trigger** — mention the bot in an allowed channel to start a conversation
 - **Thread-based multi-turn** — auto-creates threads; no @mention needed for follow-ups
 - **Edit-streaming** — live-updates the Discord message every 1.5s as tokens arrive
@@ -85,14 +85,15 @@ The bot creates a thread. After that, just type in the thread — no @mention ne
 
 ## Pluggable Agent Backends
 
-Supports Kiro CLI, Claude Code, Codex, Gemini, and any ACP-compatible CLI.
+Supports Kiro CLI, Claude Code, Codex, Gemini, OpenCode, and any ACP-compatible CLI.
 
 | Agent key | CLI | ACP Adapter | Auth |
 |-----------|-----|-------------|------|
 | `kiro` (default) | Kiro CLI | Native `kiro-cli acp` | `kiro-cli login --use-device-flow` |
 | `codex` | Codex | [@zed-industries/codex-acp](https://github.com/zed-industries/codex-acp) | `codex login --device-auth` |
 | `claude` | Claude Code | [@agentclientprotocol/claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp) | `claude setup-token` |
 | `gemini` | Gemini CLI | Native `gemini --acp` | Google OAuth or `GEMINI_API_KEY` |
+| `opencode` | OpenCode | Native `opencode acp` | `opencode auth login` |
 
 ### Helm Install (recommended)
 
@@ -158,6 +159,12 @@ command = "gemini"
 args = ["--acp"]
 working_dir = "/home/node"
 env = { GEMINI_API_KEY = "${GEMINI_API_KEY}" }
+
+# OpenCode (requires opencode in PATH; run `opencode auth login` first)
+[agent]
+command = "opencode"
+args = ["acp"]
+working_dir = "/home/opencode"
 ```
 
 ## Configuration Reference

README.md

@@ -26,6 +26,15 @@ working_dir = "/home/agent"
 # working_dir = "/home/agent"
 # env = { GEMINI_API_KEY = "${GEMINI_API_KEY}" }
 
+# [agent]
+# command = "opencode"
+# args = ["acp"]
+# working_dir = "/home/opencode"
+# # Note: opencode handles tool authorization internally and never emits
+# # session/request_permission — all tools run without user confirmation,
+# # equivalent to --trust-all-tools on other backends.
+# # Run `opencode auth login` once before starting openab.
+
 [pool]
 max_sessions = 10
 session_ttl_hours = 24