Custom loaders run before enabled_providers filtering, causing unnecessary package installs that can fail #12407

Description

Custom provider loaders in CUSTOM_LOADERS are executed for providers that are not in enabled_providers, causing unnecessary dynamic package installations that can fail in restricted network environments.

Verified in upstream dev branch at commit 8bf97ef (2026-02-06)

The custom loader loop at packages/opencode/src/provider/provider.ts:903-904 only checks disabled_providers:

// Line 903-904
for (const [providerID, fn] of Object.entries(CUSTOM_LOADERS)) {
  if (disabled.has(providerID)) continue  // ← Only checks disabled, NOT enabled!
  // ... runs custom loader which may install packages
}

However, the isProviderAllowed() function at lines 706-709 checks both enabled_providers and disabled_providers:

// Line 706-709
function isProviderAllowed(providerID: string): boolean {
  if (enabled && !enabled.has(providerID)) return false
  if (disabled.has(providerID)) return false
  return true
}

The correct isProviderAllowed() check is only applied later at line 929, after custom loaders have already run and potentially failed.

Impact

If a user configures:

{
  "enabled_providers": ["anthropic", "openai"],
  "disabled_providers": ["opencode-zen", "copilot", "openrouter"]
}

The amazon-bedrock custom loader will still run (because it's not in disabled_providers), and if the user has AWS credentials in their environment (AWS_PROFILE, AWS_ACCESS_KEY_ID, etc.), it will attempt to install @aws-sdk/credential-providers via BunProc.install() - even though bedrock is not in enabled_providers.

In corporate/restricted network environments where:

• npm registry access is blocked or requires special proxy/SSL configuration
• Users have AWS credentials configured for other purposes (not OpenCode)

OpenCode fails to start with BunInstallFailedError for a provider the user never intended to use.

Proposed Fix

Change line 904 from:

if (disabled.has(providerID)) continue

To:

if (!isProviderAllowed(providerID)) continue

This ensures custom loaders respect the full provider allowlist/blocklist logic, matching the filtering applied later at line 929.

Related Issues

• Unable to start opencode with AWS Bedrock as provider when config includes a ca_certificate #8052 - AWS Bedrock with ca_certificate fails (same error, SSL cause)
• BunInstallFailederror on First Run #6052 - BunInstallFailedError on First Run (proxy cause)
• Embedded bun runtime hangs indefinitely on bun add during bootstrap on Linux (BunInstallFailedError) #11836 - Bun hangs indefinitely on Linux (bun runtime cause)

These issues address why bun install fails, but not why it attempts to install for providers the user didn't enable.

Environment

• OpenCode version: Current dev branch (commit 8bf97ef9e5a4039e80bfb3d565d4718da6114afd)
• Affected file: packages/opencode/src/provider/provider.ts
• Bug location: Line 904
• Proposed fix location: Line 904

Plugins

No response

OpenCode version

Current dev branch (commit 8bf97ef9e5a4039e80bfb3d565d4718da6114afd)

Steps to reproduce

1. Configure AWS credentials in environment (e.g., export AWS_PROFILE=my-profile)
2. Create config with enabled_providers that does NOT include amazon-bedrock:

   {
     "enabled_providers": ["anthropic"],
     "disabled_providers": ["opencode-zen", "copilot", "openrouter"]
   }

3. Block or restrict npm registry access (or use corporate proxy without proper SSL config)
4. Run opencode

Expected: OpenCode starts successfully (bedrock not in enabled_providers)
Actual: BunInstallFailedError for @aws-sdk/credential-providers

{
  "name": "BunInstallFailedError",
  "data": {
    "pkg": "@aws-sdk/credential-providers",
    "version": "latest"
  }
}

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response