You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[FEATURE/BUG] OpenCode Zen disabled models still appear in TUI picker (config drift risk) #40560
When models are disabled in the OpenCode Zen workspace/admin dashboard, they continue to appear in the TUI model picker (/models). Selecting a disabled model results in a gateway error when initiating a prompt, but the TUI model picker provides no indication that the model is disabled or blocked.
Configuration Drift Risk & Developer Experience
Currently, the workaround suggested in closed issues (e.g. #18149) is for users to manually configure a whitelist or blacklist in their local ~/.config/opencode/opencode.json under the opencode provider key.
However, this approach introduces significant configuration drift risks:
Double Maintenance: Workspace admins / users must manage model availability in two separate places (Zen Web Dashboard and local opencode.json files).
Configuration Drift: Whenever workspace admins disable or enable models on the Zen backend, every team member's local opencode.json whitelist/blacklist becomes stale immediately. Users have no automated way to know when their local config is out of sync with workspace policies.
Inconsistent UX: Other integrated providers (e.g., GitHub Copilot) dynamically filter available models according to account/org policies.
Expected Behavior
The OpenCode Zen model catalog endpoint should filter out models disabled for the workspace (or return model metadata with a disabled: true flag).
The TUI model picker should respect the workspace status and automatically omit or disable blocked models without requiring manual sync via local opencode.json.
Steps to Reproduce
Disable specific models in the OpenCode Zen dashboard.
Launch OpenCode TUI and check /models.
Disabled models still show up in the TUI picker.
Selecting and querying a disabled model fails with a gateway error.
This issue might be a duplicate of an existing closed issue. Please check:
Models disabled in Zen dashboard show up in TUI #18149: "Models disabled in Zen dashboard show up in TUI" — this appears to describe the same root problem (disabled Zen models still appearing in the TUI model picker).
If that issue was closed without a satisfactory fix, please consider re-opening it or linking this issue to it for context. If the situation has changed or you have new information, mention that in your issue so maintainers can distinguish it from the previous report.
Same root cause visible from the API side: the gateway's models endpoint does not reflect workspace toggles, so third-party clients cannot discover the enabled set either.
Reproduction — OpenCode Go workspace with exactly one model enabled in the dashboard (deepseek-v4.1-flash):
GET https://opencode.ai/zen/go/v1/models
Authorization: Bearer <workspace Go key>
→ 200 OK with 36 models (full Go catalog: deepseek-, glm-, grok-, kimi-, qwen3.*, …), not the single enabled model.
POST https://opencode.ai/zen/go/v1/chat/completions
{"model": "glm-5.2", "messages": [{"role":"user","content":"hi"}], "max_tokens": 1}
→ 200 OK, completion returned, although glm-5.2 is disabled in the dashboard.
The docs describe this endpoint as "the full list of available models" (https://opencode.ai/docs/go/), so today no API surface exposes the workspace's enabled set. If toggles are meant to apply to the Go API, the fix belongs in the gateway: filter /models by workspace access and reject disabled models at request time. That fixes this issue, #41697, and every third-party client in one place.
Thanks for the report and the clear explanation of the double-maintenance problem.
How the model list gets built depends on your OpenCode version and on how you connected to Zen, so could you tell us:
The output of opencode --version, and whether you see this in the terminal UI, the desktop app, or both. You mentioned the desktop app hides disabled models, so please give the versions of both.
How OpenCode is connected to the workspace: signed in to your OpenCode Console account via /connect, a service-account API key, OPENCODE_API_KEY, or an OpenCode Go key.
The exact gateway error you get when you send a prompt with a disabled model.
You can reply here with the details or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know when you're done.
We haven't heard back, so I'm closing this for now. We still need your opencode --version (and whether it's the terminal UI, the desktop app or both), how OpenCode is connected to the workspace, and the exact gateway error. Without them we can't tell if this is the v1 terminal UI or a v2 bug in how the picker follows the workspace's enabled models.
If you can share those details, just reply here and we can reopen it. Related issues stay open in the meantime:
Activity
github-actions commentedon Aug 5, 2026
This issue might be a duplicate of an existing closed issue. Please check:
If that issue was closed without a satisfactory fix, please consider re-opening it or linking this issue to it for context. If the situation has changed or you have new information, mention that in your issue so maintainers can distinguish it from the previous report.
Duo-Huang commentedon Aug 8, 2026
opencode desktop supports automatic filtering, This is also inconsistent behavior.
xriu commentedon Sep 27, 2026
Same root cause visible from the API side: the gateway's models endpoint does not reflect workspace toggles, so third-party clients cannot discover the enabled set either.
Reproduction — OpenCode Go workspace with exactly one model enabled in the dashboard (
deepseek-v4.1-flash):→ 200 OK with 36 models (full Go catalog: deepseek-, glm-, grok-, kimi-, qwen3.*, …), not the single enabled model.
The enforcement side (#41697) reproduces too:
→ 200 OK, completion returned, although
glm-5.2is disabled in the dashboard.The docs describe this endpoint as "the full list of available models" (https://opencode.ai/docs/go/), so today no API surface exposes the workspace's enabled set. If toggles are meant to apply to the Go API, the fix belongs in the gateway: filter
/modelsby workspace access and reject disabled models at request time. That fixes this issue, #41697, and every third-party client in one place.opencodejr commentedon Oct 28, 2026
Thanks for the report and the clear explanation of the double-maintenance problem.
How the model list gets built depends on your OpenCode version and on how you connected to Zen, so could you tell us:
opencode --version, and whether you see this in the terminal UI, the desktop app, or both. You mentioned the desktop app hides disabled models, so please give the versions of both./connect, a service-account API key,OPENCODE_API_KEY, or an OpenCode Go key.You can reply here with the details or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know when you're done.
Related issues, most closely related first:
whitelist/blacklistworkaround came fromwhitelist/blacklistconfig is dropped as an unsupported legacy setting, so that workaround doesn't work thereopencodejr commentedon Oct 31, 2026
We haven't heard back, so I'm closing this for now. We still need your
opencode --version(and whether it's the terminal UI, the desktop app or both), how OpenCode is connected to the workspace, and the exact gateway error. Without them we can't tell if this is the v1 terminal UI or a v2 bug in how the picker follows the workspace's enabled models.If you can share those details, just reply here and we can reopen it. Related issues stay open in the meantime:
whitelist/blacklist) on v2Thanks for raising this!