inference: free-tier 403 at home, same session works on hotspot #56373

Summary

OpenCode Desktop 2.0.32 rejects DeepSeek Free requests with HTTP 403 FreeTierError on a home connection, while the same original session, account, selected model, permissions, and diagnostic prompt succeed on a phone hotspot. Returning to the home connection reproduces the failure. No client fix has been verified.

Environment

• opencode version: 2.0.32, official Desktop-bundled CLI.
• OS: macOS, Darwin 25.6.0 arm64.
• Terminal: Desktop application; diagnostic shell has TERM=xterm-256color; TERM_PROGRAM and COLORTERM unset.
• Shell: /bin/zsh.
• Install/channel: official macOS Desktop; runtime reports latest channel.
• Configured plugins: Superpowers, @dietrichgebert/ponytail, local workflow plugin, and a local model-scoped client-identification workaround. A Hindsight integration is also present in the runtime. See the isolated-client limitation below.
• Model: opencode/deepseek-v4.1-flash-free, max variant, custom primary agent.
• Home connection: Comcast/Xfinity, Vantiva-made gateway. Public IPs and account/device identifiers intentionally omitted.

Reproduction

1. In the official Desktop application, select the existing primary agent and opencode/deepseek-v4.1-flash-free, max variant.
2. On the home connection, send: Normal-network diagnostic only. Do not resume implementation, use tools, or read files. Reply exactly NORMAL_NETWORK_OK.
3. Observe the HTTP 403 below before any tool call.
4. Switch only the connection to a phone hotspot. Keep the same session, account, model, permissions, and prompt. The response is NORMAL_NETWORK_OK, with recorded cost $0.
5. Switch back to the home connection and repeat the same prompt in the same session. The HTTP 403 returns.

Expected Behavior

A legitimate request from OpenCode should work, or the error should explain the actual eligibility restriction rather than claim the user is outside OpenCode.

Actual Behavior

The client reports provider.auth, status 403. Response body:

{"type":"error","error":{"type":"FreeTierError","message":"OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building."}}

Matched observations on 2026-10-17: home failure around 06:52 UTC, hotspot success at 06:57:52 UTC, then home failure at 07:15:46 UTC. This is an observed network-dependent reproduction, not proof of a particular backend cause or general outage.

Additional Context

• The local workaround sets the DeepSeek Free User-Agent to opencode/2.0.32. It was retained across the matched network comparison. Separate home failures verified that normalized header on outgoing requests; the workaround is not sufficient. Native identification also failed in separate home controls.
• Existing-account OAuth reauthentication and fresh/private clients did not repair home access. Built-in build-agent controls on 2.0.32 and 2.0.28, with third-party plugins excluded but existing global permission rules retained, also failed at home. These isolated configurations were not paired with a known-working hotspot control; they do not fully rule out permission/toolset interactions.
• Temporary localhost CONNECT diagnostics preserved end-to-end TLS. Separate IPv4-only and IPv6-only clean-client requests failed. Initial family tests omitted the header workaround; later IPv4 controls included it and verified the outgoing header. Not every combination was tested. All diagnostic tunnels were stopped; no persistent proxy was installed.
• The home resolver's A/AAAA answers matched an independent HTTPS resolver. No enabled system HTTP/HTTPS/SOCKS proxy or proxy/custom-CA environment overrides were found. The checked certificate issuer was Google Trust Services WE1. These checks do not exclude every network or provider-edge issue.
• The user reports no matching opencode.ai events in Xfinity CyberSecure. This history was not independently inspected and does not prove filtering is absent. Protection was not disabled.
• No permissions were weakened, dummy tools added, accounts deleted, or paid models substituted as a repair. The initial error preceded later worker/tool changes.
• Related symptom reports: OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building. #55737 and policy: deny shell * on custom agent breaks free tier with "can only be used from within OpenCode" #50627. Their reported workarounds do not establish the cause of this home/hotspot reproduction.

Could maintainers advise which request/correlation metadata would be useful to provide privately, and whether backend free-tier validation could explain this network-dependent rejection? No IP ban, ISP block, or exact request-validation condition has been established.