zen: free models return 403 FreeTierError from one network while the same client and account succeed from another #56398

Description

Free-tier Console models (opencode/<model>-free) fail with
403 FreeTierError: "OpenCode's free tier can only be used from within OpenCode."
when the machine is connected to one specific network, while the same OpenCode
client, same account, and same commands succeed minutes apart from a different
network. The error is not the documented quota shape (no 429, no
Free usage exceeded, add credits, no Retry-After), and the account's free
usage is small, so this does not look like quota exhaustion.

Network A (fails): KDDI / au PPPoE line, public IP 59.138.151.215
(kd059138151215.ppp-bb.dion.ne.jp), SSID "SNTL".
Network B (works): phone tethering, AS131910 SORACOM, public IP 150.91.247.74,
SSID "0Re0さんのZ Fold7".

The failure reproduced twice on network A, and success reproduced once on
network B, by switching networks back and forth with no other changes. Raw HTTP
(no OpenCode client) is 403 from both networks as expected, but on network A the
official client is rejected too, which should not happen.

Plugins

none

OpenCode version

2.0.28 (channel: latest)

Bundled CLI used for the repro:
...\@opencodedesktop\resources\opencode-cli.exe (v2.0.28).
Note: the opencode on PATH on this machine is a V1 build (1.18.35) that cannot
read the V2 database; all tests above were run with the V2 CLI above.

Steps to reproduce

1. Connect the machine to network A (public IP 59.138.151.215).
2. Run opencode run --model opencode/deepseek-v4.1-flash-free "Reply with exactly: ok".
3. Observe exit code 1 and Error: OpenCode's free tier can only be used from within OpenCode.
4. Switch to network B (public IP 150.91.247.74) and run the same command.
5. Observe success (stdout ok).
6. Switch back to network A and run it again: failure returns.

Expected

Free models usable from any network, or at least an error that states the actual
cause (IP/ASN block, per-IP free quota, client check) with a reset hint.

Actual

403 FreeTierError with "OpenCode's free tier can only be used from within OpenCode" even though the request comes from the official client with a stored
Console account.

Affected free models on network A (all 403 FreeTierError):
deepseek-v4.1-flash-free, glm-5.3-flash-free, big-pickle, mimo-v2.6-flash-free,
space-bunny-free, longcat-2.5-preview-free, nemotron-3-ultra-free,
nemotron-3.5-lightning-free.

Same models on network B: all succeeded except nemotron-3-ultra-free,
which failed separately with [503] Upstream error from Nvidia: Service temporarily overloaded (unrelated).

Go models (opencode-go/beam-free, opencode-go/deepseek-v4.1-flash) succeed on
both networks, so the client and credentials work from network A as well.

Screenshot and/or share link

Unavailable

Operating System

Windows 11 (Windows_NT 10.0.26200)

Terminal

PowerShell 5.1 / Windows Terminal (also reproduced with raw curl.exe)

Additional context

• x-opencode-log-id for a raw HTTP 403 on network A:
  c580b8cc-395f-4ba9-a9c8-159300579b9f (2026-10-17T12:58:59Z, Cloudflare edge
  -SEA).
• Timeline (2026-10-17, UTC), from the local opencode log:
  • 12:50-12:51 failures (user's own attempts, network A)
  • 12:57-13:04 failures (tests, network A; raw HTTP and CLI)
  • 13:05-13:08 successes (network B, same CLI/account)
  • 13:18 failures again (network A)
• No VPN or proxy on the machine (WinHTTP direct; HTTP(S)_PROXY unset).
• IPv6 is not the cause: curl -6 cannot reach opencode.ai from network A;
  all traffic egresses over IPv4 (172.65.90.x).
• The raw HTTP body is identical from both networks for unauthenticated
  requests, so the 403 message itself does not distinguish "not the client"
  from any network-level decision.
• Questions: is the free tier gated on IP/ASN reputation or a per-IP free quota?
  Can the error message expose the actual scope (account / IP / model) and a
  reset hint, like the 429 path does?