serve: GET /api/model omits auth.json providers

serve: GET /api/model omits auth.json providers

Problem

GET /api/model on opencode serve leaves out every provider whose credentials live in ~/.local/share/opencode/auth.json. The CLI lists them. The server will even start sessions with them. They just never appear in the list.

Context

I hit this through T3 Code, which spawns opencode serve and builds its model picker from the API. My config default is zai-coding-plan/glm-5.3. It works fine in the TUI. Inside T3 the model is absent from the picker, so it looks like the provider vanished.

Any client that spawns a server and lists models over the API will hit this.

Reproduction

opencode 1.18.18, macOS.

1. opencode auth login for a provider (zai-coding-plan here). Check opencode models | grep zai-coding-plan: the models appear.
2. opencode serve --hostname 127.0.0.1 --port 4100
3. List models:

curl -s -H "x-opencode-directory: $HOME" http://127.0.0.1:4100/api/model \
  | jq -r '.data[].providerID' | sort -u

I get 9 providers: openrouter, google, openai, xai, cerebras, cloudflare-ai-gateway, cloudflare-workers-ai, sakana, opencode. All keyed by env vars or catalog entries. No zai-coding-plan, no opencode-go, no kimi-for-coding, no fireworks-ai. All four of those are type: api entries in auth.json.

1. Now ask the same server for a session with the "missing" model:

curl -s -X POST -H "x-opencode-directory: $HOME" -H 'content-type: application/json' \
  -d '{"providerID":"zai-coding-plan","modelID":"glm-5.3","title":"probe"}' \
  http://127.0.0.1:4100/api/session

Returns a session ID. Streaming with that model works too.

Two side notes. The x-opencode-directory header is required, otherwise data comes back empty and will waste your repro time. Setting OPENCODE_SERVER_PASSWORD does not change the outcome.

Expected behavior

The list includes models from authenticated providers. If leaving them out is intentional, the endpoint docs should say it lists only config and env-keyed providers.

Notes

I have not traced the handler. My guess: the v2 list builds from catalog, config and env credentials and never reads the auth store. The session path clearly does.