anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Custom loaders run before enabled_providers filtering, causing unnecessary package installs that can fail #8669

New Issue
Open
opened 2026-02-16 18:10:32 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:10:32 -05:00
Owner
Copy Link
Copy Source

Originally created by @ShanePresley on GitHub (Feb 5, 2026).

Originally assigned to: @thdxr on GitHub.

Description

Custom provider loaders in CUSTOM_LOADERS are executed for providers that are not in enabled_providers, causing unnecessary dynamic package installations that can fail in restricted network environments.

Verified in upstream dev branch at commit 8bf97ef (2026-02-06)

The custom loader loop at packages/opencode/src/provider/provider.ts:903-904 only checks disabled_providers:

// Line 903-904
for (const [providerID, fn] of Object.entries(CUSTOM_LOADERS)) {
  if (disabled.has(providerID)) continue  // ← Only checks disabled, NOT enabled!
  // ... runs custom loader which may install packages
}

However, the isProviderAllowed() function at lines 706-709 checks both enabled_providers and disabled_providers:

// Line 706-709
function isProviderAllowed(providerID: string): boolean {
  if (enabled && !enabled.has(providerID)) return false
  if (disabled.has(providerID)) return false
  return true
}

The correct isProviderAllowed() check is only applied later at line 929, after custom loaders have already run and potentially failed.

Impact

If a user configures:

{
  "enabled_providers": ["anthropic", "openai"],
  "disabled_providers": ["opencode-zen", "copilot", "openrouter"]
}

The amazon-bedrock custom loader will still run (because it's not in disabled_providers), and if the user has AWS credentials in their environment (AWS_PROFILE, AWS_ACCESS_KEY_ID, etc.), it will attempt to install @aws-sdk/credential-providers via BunProc.install() - even though bedrock is not in enabled_providers.

In corporate/restricted network environments where:

  • npm registry access is blocked or requires special proxy/SSL configuration
  • Users have AWS credentials configured for other purposes (not OpenCode)

OpenCode fails to start with BunInstallFailedError for a provider the user never intended to use.

Proposed Fix

Change line 904 from:

if (disabled.has(providerID)) continue

To:

if (!isProviderAllowed(providerID)) continue

This ensures custom loaders respect the full provider allowlist/blocklist logic, matching the filtering applied later at line 929.

Related Issues

  • #8052 - AWS Bedrock with ca_certificate fails (same error, SSL cause)
  • #6052 - BunInstallFailedError on First Run (proxy cause)
  • #11836 - Bun hangs indefinitely on Linux (bun runtime cause)

These issues address why bun install fails, but not why it attempts to install for providers the user didn't enable.

Environment

  • OpenCode version: Current dev branch (commit 8bf97ef9e5a4039e80bfb3d565d4718da6114afd)
  • Affected file: packages/opencode/src/provider/provider.ts
  • Bug location: Line 904
  • Proposed fix location: Line 904

Plugins

No response

OpenCode version

Current dev branch (commit 8bf97ef9e5a4039e80bfb3d565d4718da6114afd)

Steps to reproduce

  1. Configure AWS credentials in environment (e.g., export AWS_PROFILE=my-profile)
  2. Create config with enabled_providers that does NOT include amazon-bedrock: 
    {
  "enabled_providers": ["anthropic"],
  "disabled_providers": ["opencode-zen", "copilot", "openrouter"]
}
  3. Block or restrict npm registry access (or use corporate proxy without proper SSL config)
  4. Run opencode

Expected: OpenCode starts successfully (bedrock not in enabled_providers)
Actual: BunInstallFailedError for @aws-sdk/credential-providers

{
  "name": "BunInstallFailedError",
  "data": {
    "pkg": "@aws-sdk/credential-providers",
    "version": "latest"
  }
}

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @ShanePresley on GitHub (Feb 5, 2026). Originally assigned to: @thdxr on GitHub. ### Description Custom provider loaders in `CUSTOM_LOADERS` are executed for providers that are not in `enabled_providers`, causing unnecessary dynamic package installations that can fail in restricted network environments. **Verified in upstream `dev` branch at commit [`8bf97ef`](https://github.com/anomalyco/opencode/commit/8bf97ef9e5a4039e80bfb3d565d4718da6114afd) (2026-02-06)** The custom loader loop at `packages/opencode/src/provider/provider.ts:903-904` only checks `disabled_providers`: ```typescript // Line 903-904 for (const [providerID, fn] of Object.entries(CUSTOM_LOADERS)) { if (disabled.has(providerID)) continue // ← Only checks disabled, NOT enabled! // ... runs custom loader which may install packages } ``` However, the `isProviderAllowed()` function at lines 706-709 checks **both** `enabled_providers` and `disabled_providers`: ```typescript // Line 706-709 function isProviderAllowed(providerID: string): boolean { if (enabled && !enabled.has(providerID)) return false if (disabled.has(providerID)) return false return true } ``` The correct `isProviderAllowed()` check is only applied **later** at line 929, after custom loaders have already run and potentially failed. ## Impact If a user configures: ```json { "enabled_providers": ["anthropic", "openai"], "disabled_providers": ["opencode-zen", "copilot", "openrouter"] } ``` The `amazon-bedrock` custom loader will still run (because it's not in `disabled_providers`), and if the user has AWS credentials in their environment (`AWS_PROFILE`, `AWS_ACCESS_KEY_ID`, etc.), it will attempt to install `@aws-sdk/credential-providers` via `BunProc.install()` - even though bedrock is not in `enabled_providers`. In corporate/restricted network environments where: - npm registry access is blocked or requires special proxy/SSL configuration - Users have AWS credentials configured for other purposes (not OpenCode) OpenCode fails to start with `BunInstallFailedError` for a provider the user never intended to use. ## Proposed Fix Change line 904 from: ```typescript if (disabled.has(providerID)) continue ``` To: ```typescript if (!isProviderAllowed(providerID)) continue ``` This ensures custom loaders respect the full provider allowlist/blocklist logic, matching the filtering applied later at line 929. ## Related Issues - #8052 - AWS Bedrock with ca_certificate fails (same error, SSL cause) - #6052 - BunInstallFailedError on First Run (proxy cause) - #11836 - Bun hangs indefinitely on Linux (bun runtime cause) These issues address *why* bun install fails, but not *why* it attempts to install for providers the user didn't enable. ## Environment - **OpenCode version:** Current `dev` branch (commit `8bf97ef9e5a4039e80bfb3d565d4718da6114afd`) - **Affected file:** `packages/opencode/src/provider/provider.ts` - **Bug location:** Line 904 - **Proposed fix location:** Line 904 ### Plugins _No response_ ### OpenCode version Current `dev` branch (commit `8bf97ef9e5a4039e80bfb3d565d4718da6114afd`) ### Steps to reproduce 1. Configure AWS credentials in environment (e.g., `export AWS_PROFILE=my-profile`) 2. Create config with `enabled_providers` that does NOT include `amazon-bedrock`: ```json { "enabled_providers": ["anthropic"], "disabled_providers": ["opencode-zen", "copilot", "openrouter"] } ``` 3. Block or restrict npm registry access (or use corporate proxy without proper SSL config) 4. Run `opencode` **Expected:** OpenCode starts successfully (bedrock not in enabled_providers) **Actual:** `BunInstallFailedError` for `@aws-sdk/credential-providers` ```json { "name": "BunInstallFailedError", "data": { "pkg": "@aws-sdk/credential-providers", "version": "latest" } } ``` ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:10:32 -05:00
yindo commented 2026-02-16 18:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 5, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #4407: disabled_providers config for Bedrock ignored when AWS credentials available via environment variables

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Feb 5, 2026): This issue might be a duplicate of existing issues. Please check: - #4407: disabled_providers config for Bedrock ignored when AWS credentials available via environment variables Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8669
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?