third-party integrations stored but never selectable after 2.2.5 upgrade #60997

Description

Summary

Possibly a 2.2.5 regression — third-party providers were working the day before the upgrade.

Integrations connected through opencode auth login (Kimi For Coding, Zhipu AI Coding Plan, DeepSeek, Xiaomi Token Plan) are no longer usable: opencode auth list shows them as stored, but opencode models only lists the two workspace-managed providers opencode and opencode-go, and addressing a third-party model explicitly fails with Model unavailable.

opencode debug config shows a workspace-document policy provider.use: {"resource":"*","effect":"deny"} with narrow allow entries for opencode / opencode-go only. This correlates with the symptom, but it is a lead, not a confirmed root cause — I could not verify that removing the policy restores the providers.

Timeline (Asia/Shanghai): third-party providers usable on 2026-10-31; opencode upgraded 2026-10-31 09:35 (now reporting 2.2.5); on 2026-11-01 they are gone. The previous version number was not recorded, so the exact last-known-good build is unknown.

Environment

• opencode version: 2.2.5
• OS: Linux 6.6.87.2-microsoft-standard-WSL2 (x86_64), Ubuntu on WSL2
• Terminal: xterm-256color (TERM_PROGRAM=vscode, COLORTERM=truecolor)
• Shell: /bin/zsh
• Install/channel: latest (release)
• Active plugins: @cortexkit/opencode-magic-context@latest, superpowers@git+https://github.com/obra/superpowers.git

Reproduction

1. opencode auth login → connect Kimi For Coding (kimi.com) and Zhipu AI Coding Plan (both complete successfully; the integration screen shows them checked).
2. Confirm the credentials are stored: opencode auth list prints both as stored (plus DeepSeek / Xiaomi Token Plan / OpenCode Go / OpenCode Console).
3. List models: opencode models.
4. Observe that only opencode/* and opencode-go/* entries are printed — no kimi-code-plan-cn/*, no zhipuai-coding-plan/*, no deepseek/*.
5. Inspect resolved config: opencode debug config.

Expected Behavior

After an integration is connected with a stored credential, its provider and models should be selectable — e.g. kimi-code-plan-cn/k3, zhipuai-coding-plan/glm-5.3 — regardless of which workspace-managed providers exist.

Actual Behavior

opencode models output is limited to two providers, even though the third-party credentials are stored:

$ opencode models | awk -F/ '{print $1}' | sort | uniq -c
   43 opencode
   30 opencode-go

The managed config document denies everything else and declares only those two providers:

"policies": [
  { "action": "provider.use", "resource": "*",           "effect": "deny"  },
  { "action": "provider.use", "resource": "opencode",    "effect": "allow" },
  { "action": "provider.use", "resource": "opencode-go", "effect": "allow" }
]

providers in managed doc: ['opencode', 'opencode-go']

Third-party models are unusable not only in the list but also when addressed explicitly:

$ opencode run -m deepseek/deepseek-v4.1-flash "reply OK"
Error: Model unavailable: deepseek/deepseek-v4.1-flash

opencode auth list:

OpenCode Go                 API key                     stored
DeepSeek                    API key                     stored
Kimi For Coding (kimi.com)  Kimi For Coding (kimi.com)  stored
OpenCode Console            Default                     stored
opencode_console            opencode_console            stored
Xiaomi Token Plan (China)   API key                     stored
Zhipu AI Coding Plan        API key                     stored

The credentials are also present and active in the local database (credential table: kimi-code-plan-cn, zhipuai-coding-plan, deepseek, xiaomi-token-plan-cn, opencode-go — all active = 1), and both kimi-code-plan-cn and zhipuai-coding-plan exist in the local models catalog with their model lists. So the metadata and credentials are all there — only the policy keeps them out.

Additional Context

• Reproducible consistently, on 2.2.5, in every new session (not a per-session cache issue).
• Regression signal: the same setup worked the day before the upgrade (details in Summary). The upgrade was done with the standard opencode upgrade flow; no config changes were made around that time.
• Enabling/disabling workspace models has no effect on third-party providers — it only toggles opencode/* models, which are OpenCode's own.
• The Kimi and Zhipu integrations are explicitly offered in the "Connect an integration" screen and report success, which makes the outcome especially confusing: the UI says connected, the credential is stored, but the provider can never be selected.
• Suggested directions:
  1. Have auth login (or the workspace sync) add the connected provider to the managed document, mirroring the credential it just stored.
  2. Or make provider.use policy default to allowing locally-authenticated providers, so a managed allowlist only narrows opencode-hosted models.
  3. At minimum, surface a clear error/warning at connect time when the workspace policy denies the provider, instead of silently hiding it.
• No secrets included; identifiers such as account IDs and table/row ids are omitted.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot

No response

Operating System

No response

Terminal

No response