Free models rejected with "can only be used from within OpenCode" on residential ISP (AS7303, Argentina); work through Cloudflare WARP (v2.0.32, Windows 11) #56570

Description

Summary

Every OpenCode free model is rejected with this error in the official client:

OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building.

The failure depends on the network. With the same machine, install and config, the error appears on my normal residential connection (AS7303) and goes away when I route through Cloudflare WARP (AS13335). Nothing client-side explains it, so the error text points in the wrong direction.

Related: #56324 (same symptoms and version, with similar network-dependence reports).

Environment

• OS: Windows 11 Pro (10.0.26200), x64
• OpenCode: v2.0.32, channel latest. The built-in update check reports up-to-date
• Install layout (both 2.0.32): CLI via the npm global shim (@opencode/cli), talking to the background service installed by OpenCode Desktop (ai.opencode.desktop\cli\2.0.32-x64\opencode-cli.exe serve --service)
• Node: v26.2.0
• Auth: no OpenCode/Zen credential stored (auth.json has no opencode entry), so I am using the anonymous free tier
• Physical desktop, not a VM/VPS
• No VPN or virtual adapters, no system proxy (ProxyEnable=0, no PAC), no HTTP_PROXY/HTTPS_PROXY/ALL_PROXY env vars, hosts file clean

A/B result (key finding)

Only the egress network changed. The machine, install, config, MCP servers and credentials were identical.

Models tried without WARP: GLM-5.3-Flash Free, DeepSeek V4.1 Flash Free, MiMo-V2.6-Flash Free, Beam Free. All failed identically. [FILL IN: model(s) tested with WARP on]

Timeline from my local log

From ~/.local/share/opencode/log/opencode.log (UTC):

• First free-tier error: 2026-10-17 05:22:23Z
• 20 errors between 05:22Z and 19:34Z, all on that day
• The log goes back to 2026-08-23 and has zero earlier occurrences

This matches the other reports in #56324 of a change around Oct 16–17. The reports there are on different ISPs, OSes and countries.

Log evidence

Representative entry (user paths redacted):

timestamp=2026-10-17T19:34:14.255Z level=ERROR run=e0236987 message="Failed to drain Session" cause="AI.Error: OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building.
    at JJ (B:/~BUN/root/chunk-fgtjesq4.js:6:3619)
    at <anonymous> (B:/~BUN/root/chunk-fgtjesq4.js:6:3312)
    at SessionStep.attempt (B:/~BUN/root/chunk-z20sjgqk.js:382:3574)
    at SessionRunner.runStep (B:/~BUN/root/chunk-z20sjgqk.js:382:2672)
    at SessionRunner.drain (B:/~BUN/root/chunk-4e2rqd16.js:18:2552)
    at ServerProcess.start (B:/~BUN/root/chunk-94gxrctf.js:2:7603) {
  [cause]: AI.Error.Authentication: OpenCode's free tier can only be used from within OpenCode. Download it at https://opencode.ai and keep building.
      at Uf (B:/~BUN/root/chunk-fgtjesq4.js:6:574)
      at JJ (B:/~BUN/root/chunk-fgtjesq4.js:6:3630)
}" role=server sessionID=ses_eb4a4733bffee2NIBqSJy8jkZW

The client starts normally and the update check passes just before the failure:

message="cli starting" version=2.0.32 channel=latest local=false
message="update check" current=2.0.32 latest=2.0.32
message="update check done" action=up-to-date

What I ruled out

• Client version: on the latest per the built-in update check
• Config: current opencode.jsonc has only two local MCP servers (Roblox Studio, Madium), with no provider.opencode block, no custom base URL or headers on the opencode provider, no deny rules, no project-level config in the affected folders, and no user plugins (~/.config/opencode only has @opencode-ai/plugin). An older config backup did override context/output limits for deepseek-v4.1-flash-free, but that override is gone and the error persisted
• Third-party wrapper: requests come from the official TUI and the official background service
• Install layout, MCP servers, credentials: all identical in both halves of the A/B, so none of them can explain the difference
• VPN/proxy/datacenter IP: none. The failing connection is a plain residential line

Conclusion (hypothesis, not confirmed)

The rejection depends on the source network, not on the client or config. This is consistent with an IP- or ASN-reputation check on the gateway side. Other reporters in #56324 describe the same behaviour on other ISPs, and that thread also reports that overriding the User-Agent no longer helps, and that a paid model on the same key returns 402 while only the free tier is rejected. I can't see the gateway, so I can't tell whether it is reputation, geography, or something else tied to the network.

Suggestions for maintainers

• Check what the reputation or trust source says about AS7303 (Argentina) ranges around Oct 16–17
• Make the error message reflect network or IP rejections when that is the cause. "Can only be used from within OpenCode" sends users to debug auth, config and client identity, which is wasted effort when the real variable is the ISP
• Document the network-dependent failure mode and the WARP workaround

Workaround

Cloudflare WARP (free). Free models responded normally as soon as it was on. It routes all traffic through Cloudflare, so I turn it off when not using OpenCode.

I'm happy to run any probe on this machine.

Plugins

None. Full clean install, just mcp server that dont have nothing to do with.

OpenCode version

• OpenCode: v2.0.32, channel latest. The built-in update check reports up-to-date - Install layout (both 2.0.32): CLI via the npm global shim (@opencode/cli), talking to the background service installed by OpenCode Desktop (ai.opencode.desktop\cli\2.0.32-x64\opencode-cli.exe serve --service)

Steps to reproduce

Steps to reproduce

1. Use a residential connection on AS7303 (Argentina), without a VPN
2. Open OpenCode (TUI) with the Build agent
3. Select any opencode/*-free model (e.g. DeepSeek V4.1 Flash Free)
4. Send any prompt
5. The error appears immediately, and every other free model fails the same way
6. Turn on Cloudflare WARP and repeat. Free models respond

Expected / actual

• Expected: free models respond when the official client is used
• Actual: rejected with the error above. The client logs it as AI.Error.Authentication. Paid/custom providers I have configured (@ai-sdk/openai-compatible) are unaffected

Screenshot and/or share link

Operating System

• OS: Windows 11 Pro (10.0.26200), x64

Terminal

Windows PowerShell and Desktop App.