Skip to content

restrict amazon-bedrock provider to curated model allowlist#15

Open
lgarceau768 wants to merge 3 commits intoflexfrom
task/bedrock-model-allowlist
Open

restrict amazon-bedrock provider to curated model allowlist#15
lgarceau768 wants to merge 3 commits intoflexfrom
task/bedrock-model-allowlist

Conversation

@lgarceau768
Copy link
Copy Markdown
Collaborator

Issue for this PR

Closes #

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Adds a hardcoded BEDROCK_ALLOWED_MODELS set in packages/opencode/src/provider/provider.ts that restricts the amazon-bedrock provider to a curated list of 30 approved models. The filter runs inside the existing provider initialization loop, immediately after the deprecated status check and before the config blacklist/whitelist check.

Approved models by family:

  • Anthropic/Claude: Sonnet 4.6 (US), Opus 4.6 (US), Haiku 4.5 (US)
  • Google Gemma (Bedrock): 27B, 12B, 4B
  • OpenAI/GPT (Bedrock): GPT Safeguard 120B, GPT Safeguard 20B
  • Amazon Nova: Nova 2 Lite
  • Qwen: 235B, 80B, 32B, Coder 30B
  • NVIDIA Nemotron: Nano 30B, Nano 12B, Nano 9B
  • Mistral: Large 675B, Magistral Small, Ministral 14B, Ministral 8B, Voxtral 24B
  • DeepSeek: R1
  • Minimax: M2
  • Moonshot/Kimi: K2 (kimi-k2.5), K2 Thinking
  • ZAI/GLM: GLM-4.7, GLM-4.7 Flash
  • Writer/Palmyra: X5, X4
  • Meta/Llama: Llama 3.1 8B

Because the built-in allowlist runs before the config-level whitelist/blacklist, users can still add custom models (e.g. a Bedrock fine-tune) via their opencode config without being blocked.

How did you verify your code works?

  • Ran bun typecheck in packages/opencode — passes clean.
  • Verified the 30 model IDs against the current models-snapshot.js to confirm each entry exists and maps to the expected model.

Screenshots / recordings

N/A — no UI change.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Adds a hardcoded BEDROCK_ALLOWED_MODELS Set in the provider
initialization loop that filters the amazon-bedrock provider
down to 30 approved models across Claude, Gemma, GPT Safeguard,
Nova 2 Lite, Qwen, Nemotron, Mistral, DeepSeek, Minimax, Kimi,
GLM, Palmyra, and Llama families.

The allowlist runs before the existing config blacklist/whitelist
check, so users can still override via config (e.g. to add a
custom Bedrock fine-tune).
@github-actions
Copy link
Copy Markdown

Hey! Your PR title restrict amazon-bedrock provider to curated model allowlist doesn't follow conventional commit format.

Please update it to start with one of:

  • feat: or feat(scope): new feature
  • fix: or fix(scope): bug fix
  • docs: or docs(scope): documentation changes
  • chore: or chore(scope): maintenance tasks
  • refactor: or refactor(scope): code refactoring
  • test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

@github-actions
Copy link
Copy Markdown

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

  • No issue referenced. Please add Closes #<number> linking to the relevant issue.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

The allowlist check was incorrectly deleting models that users
explicitly added via config (provider["amazon-bedrock"].models).
Add a guard so the filter only applies to snapshot-sourced models,
not ones the user has explicitly defined in their opencode.json.
Fast-exiting commands (e.g. echo test) could produce (no output)
because Effect.forkScoped interrupted the stream consumer fiber
before it had a chance to process chunks buffered in the Node.js
readable pipe.

Fix by joining the fiber after the exit/abort/timeout race so all
buffered stdout/stderr is flushed into the accumulator list before
Effect.scoped disposes the scope.
@lgarceau768
Copy link
Copy Markdown
Collaborator Author

Rebuilt, tested locally and confirmed only the models within the model document - also FlexChat - are shown here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant