disabled_providers config for Bedrock ignored when AWS credentials available via environment variables #4407

Description

When using aws-vault (or any other tool that sets AWS credentials via environment variables like AWS_ACCESS_KEY_ID, AWS_SESSION_TOKEN, etc.), the Bedrock provider is loaded and its models appear in /models, even though bedrock is explicitly listed in the disabled_providers configuration.

Expected Behavior

According to the official documentation:

The disabled_providers option accepts an array of provider IDs. When a provider is disabled:

• It won't be loaded even if environment variables are set.
• It won't be loaded even if API keys are configured through opencode auth login.
• The provider's models won't appear in the model selection list.

Bedrock models should NOT appear in the model selection when bedrock is in disabled_providers, regardless of AWS credentials being available.

Actual Behavior

When AWS credentials are present in the environment (e.g., when logged in with aws-vault exec my-profile -- opencode), Bedrock models appear in /models despite the configuration.

OpenCode version

1.0.68

Steps to reproduce

1. Add bedrock to disabled_providers in ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "disabled_providers": ["bedrock"]
}

2. Login with aws-vault (or set AWS credentials via environment variables):

aws-vault exec my-profile -- opencode

3. Run /models command

4. Observe that Bedrock models are shown in the list

Expected Result: No Bedrock models should appear

Actual Result: Bedrock models appear in the model selection

Screenshot and/or share link

No response

Operating System

macOS

Terminal

iTerm2