I hid nearly every OpenCode model in Settings → Providers, leaving opencode-go/deepseek-v4.1-flash visible. A Claude parent thread nevertheless started two T3-owned OpenCode subagents using opencode-go/deepseek-v4-pro. Both completed.
I expected my model preferences to apply to delegated agents too. This allows agents to select models I deliberately removed from the picker.
This is especially painful with OpenCode Go. I deliberately chose Flash to preserve my allowance. I do not want an agent to spawn more expensive Pro workers automatically and rapidly consume my entire OpenCode Go allowance. Model restrictions need to apply before any delegated work starts, rather than relying on the parent to follow a prompt. This is the reporter's cost-control concern; the exact allowance consumed by these two tasks was not measured during triage.
VERIFIED by inspecting the installed app bundle for the version below: orchestrator_capabilities exposes every model returned by the provider registry. Delegation's resolveTarget validates a requested model against that full catalog, without applying hiddenModels. The installed server bundle contains hiddenModels only in settings schema definitions.
VERIFIED in the UI source: the switches control visibility in the model picker. This is therefore a mismatch between model preferences and delegation, rather than evidence of bypassing an existing execution denylist. If picker-only behavior is intentional, the UI should make that limitation clear and provide a separate restriction for delegated agents.
The reporter's hidden-model selection is user-reported; its state at the time of delegation was not independently recovered. No fresh paid delegation was started during triage.
Suggested focused reproduction, not rerun during triage:
orchestrator_capabilities.delegate_task with target provider instance opencode and model opencode-go/deepseek-v4-pro.Expected: delegation respects the user's model restrictions, or clearly distinguishes picker visibility from execution permissions. Observed in the original session: two Pro tasks were accepted and completed.
0.0.46-nightly.20261005.2667
macOS darwin arm64 27.0.0; Node v26.8.2. T3 desktop backend on a local server. Parent provider: Claude Agent; delegated provider: OpenCode.
Read-only SQLite query of orchestration_v2_projection_subagents for the reported parent thread found:
| Started at, UTC | Provider instance | Model | Status |
|---|---|---|---|
| 2026-10-05 08:30:18.331 | opencode | opencode-go/deepseek-v4-pro | completed |
| 2026-10-05 08:30:31.622 | opencode | opencode-go/deepseek-v4-pro | completed |
Installed app.asar package version matches the reported version. Its server bundle confirms the catalog and validation behavior described above.
Source reference: https://github.com/pingdotgg/t3code/blob/main/apps/server/src/mcp/OrchestratorMcpService.ts (capabilities and resolveTarget).
#11031 concerns Android showing models hidden on Desktop. This report concerns T3-owned delegated execution, not the Android picker. No exact duplicate was found in public issue searches.
No changes made to app settings, the database, or T3 source. Explicitly requesting Flash in delegation prompts is a possible workaround, but is not an enforced restriction.
Codex, GPT-6, via t3 triage.
Rechecked on upstream main (701fc83). #16816 removes hidden models from the list orchestrator_capabilities gives agents, which helps. But resolveTarget in OrchestratorMcpService.ts still checks a requested model against the provider's full model list, so a delegate_task that names a hidden model (e.g. deepseek-v4-pro) still starts. Keeping this open until the server rejects hidden models there too.
Another case for this. I use CLIProxyAPI, so Claude models also show up in Codex's model catalog. Orchestrator V2 delegated a task to codex / claude-fable-5-1, which runs a Claude model inside the Codex harness. That breaks Anthropic's subscription terms for me, so I'd need to hide Claude models under codex while keeping them under claudeAgent, and have delegate_task enforce it.
So +1 for this issue.
We really need enforced worker-model permissions. Its not acceptable that subagents can simply go rogue!
Reproduced through isolated MCP HTTP transport with SQLite orchestration and synthetic OpenCode inventory: capabilities omitted the hidden Pro model, but explicit delegation persisted a child task. The fix rejects the same request with model_unavailable before dispatch and leaves no child record. Focused service/toolkit checks: 38 passed. Two independent code reviews found no blocker; runtime proof was independently rerun. Fix and transcripts: #23353. No paid provider execution or live user state was used.
