OpenCode: Providers, Zen, Permissions, and GLM-5.2

October 3 Zen roster and DeepSeek update

Scoped vendor check, October 3, 2026: OpenCode Zen’s live pricing page lists 12 free-priced model entries, each described as limited-time. The dated roster below records their exact Zen IDs and the privacy exceptions OpenCode names. It does not establish that an account can access a model, or that an offer will remain available. We did not sign in, submit prompts, or test output quality, latency, rate limits, quotas, or editorial suitability; this is not a full technical recheck of this guide.

The September 27 Go allowance check owns Go’s plan and allowance terms. Go is separate from Zen balance; the DeepSeek guide owns the direct API route.

OpenCode is the best general-purpose harness in this cluster when you want broad providers, reusable agents, explicit permissions, and terminal/desktop/IDE/GitHub workflows. It is an open-source coding agent; OpenCode Zen is an optional hosted provider, not the product’s only way to run.

Zen is an optional hosted gateway, not a permanent free entitlement. Its setup instructions say to add billing details and credits, and that usage is charged per request. The model rows marked Free are temporary offers; their current account eligibility, limits, and expiry are unresolved here.

Quick facts

Install OpenCode

The repository documents:

1
2

npm i -g opencode-ai@latest
opencode

It also publishes Homebrew, Chocolatey, Scoop, Arch, install-script, and desktop-app paths. Prefer a package manager you already trust and pin versions in managed environments.

Three GLM-5.2 Paths

These routes use different accounts and billing rules.

1. OpenCode Zen

Zen is OpenCode’s optional curated gateway:

1
2
3

/connect
# Select OpenCode Zen and enter the Zen API key
/models

Current Zen docs list GLM-5.2 among available models. They also say users add billing details and credits and are charged per request. Check the live pricing table before use; do not rely on an old free-model roster.

Free-priced Zen roster — October 3, 2026

The live Zen table marks all 12 entries below Free for input and output tokens; all are described as limited-time, with no end dates shown. Zen requires billing details, charges per request, and lets users add credits. Its auto-reload setting is documented to add $20 when balance falls below $5; we did not inspect an account setting.

Use the bare ID in the Zen model table; OpenCode configuration adds the opencode/ prefix. Suggested probes below are synthetic editorial comparisons, not claims about model capability. No editorial test or site-owned quality measurement was run.

Data and offer codes. OpenCode says its providers generally use zero retention and do not train, subject to the model-specific exceptions below. Retention periods for I, N, and M are not stated.

• I: free-period data may be used for feedback or model improvement.
• Z: provider explicitly states zero retention and no training.
• N: Zen explicitly prohibits personal or confidential inputs on these NVIDIA endpoints. Trial API use and generated content are excluded from production. Sessions are logged for security and model improvement; duration is unstated.
• M: prompts and completions may train future Meta models. Zen lists $0; Meta’s separate Contributor API page shows discounted paid rates, which do not establish Zen account charges.
• J: inputs are not used for training; TypeSafe describes retention as reasonably necessary but gives no fixed prompt window. Jev evaluates typed decisions instead of generating text, so it is not coding chat or a copywriting model.

Jev supports yes/no, multiple-choice, and rubric-score questions. The free Jev route is limited-time.

The Zen page does not list per-model quotas, eligibility, or end dates. Verify the live offer and account terms before use.

DeepSeek Zen pricing: dated August terms

The August 20, 2026 Zen table listed separate peak and off-peak DeepSeek prices. Those amounts and peak hours are historical, not current buying guidance. The October 3 live page shows updated model prices without that schedule; check the current Zen pricing table before use.

The August 11 lab preflight that reached opencode/deepseek-v4-flash-free remains dated historical evidence. The current Zen roster does not list it as free; do not rely on the old route as current buying advice.

2. Direct Z.AI PAYG

Use a Z.AI API key and choose the standard Z.AI provider:

1
2
3

opencode auth login
# Select: Z.AI
opencode

This is normal API billing. See GLM-5.2 for current list pricing.

3. Z.AI GLM Coding Plan

Z.AI documents OpenCode as an officially supported Coding Plan tool:

1
2
3

opencode auth login
# Select: Z.AI Coding Plan
opencode

Enter the relevant Z.AI key, then use /models to select GLM-5.2. Coding Plan five-hour/weekly quotas and supported-use rules apply; this is not general PAYG credit and not unlimited usage. See the Z.AI Coding Plan guide.

Agents and Permissions

OpenCode supports primary agents and subagents with per-agent prompts, tools, models, and permissions. Permission rules can allow, ask, or deny individual tools and shell-command patterns.

A read-only review agent can deny edits and network access while allowing repository search:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

{
  "$schema": "https://opencode.ai/config.json",
  "agent": {
    "review": {
      "mode": "subagent",
      "permission": {
        "edit": "deny",
        "webfetch": "deny",
        "bash": {
          "*": "ask",
          "git diff*": "allow",
          "git log*": "allow",
          "rg *": "allow"
        }
      }
    }
  }
}

Last-match precedence matters in command patterns. Keep the broad rule first and narrow exceptions after it, then test the policy on a disposable repository.

Context, Sharing, and Privacy

Provider choice controls much of the data path. A local OpenCode client with a BYO key still sends prompts and selected code to that provider unless you use a local model.

OpenCode’s session-sharing feature creates a public link and syncs conversation history to OpenCode’s servers. Treat sharing as an explicit publication step: review source, secrets, terminal output, and generated URLs before enabling it. The Claude shared-chat search incident shows why an unguessable public link can become discoverable after it is posted on a crawlable page.

OpenCode says its Zen models are hosted in the United States and that providers generally follow zero retention and do not train on customer data, subject to the named exceptions in the dated roster above. A local OpenCode client with a hosted provider still sends prompts and selected code to that provider. “Open source client” does not mean “local inference.”

Productive Starting Prompt

1
2
3
4

Audit this repository for untrusted input reaching shell execution.
Use the read-only review agent. Do not edit, install, or use the network.
Return file:line evidence, reachable data flow, severity, and uncertainty.
Separate confirmed findings from hypotheses.

For failing-test and multi-file prompts plus a same-model scorecard, use Pi vs ZCode vs OpenCode.

Choose OpenCode When

• You need to switch among providers without changing the whole harness.
• Explicit tool, shell, and subagent permissions are important.
• Terminal, desktop, IDE, and GitHub surfaces should share one workflow.
• You want a clear choice among Zen, BYO-provider PAYG, and supported Coding Plan access.

Choose ZCode for the most integrated GLM-5.2-native desktop test. Choose Pi for a smaller terminal core with highly programmable lifecycle hooks.

Related links

• /lab/investigations/agents-running-agents/ — A dated Codex-to-OpenCode-to-DeepSeek connection probe and the safety boundary built around it

• /lab/investigations/toybox-clock/ — Protocol preview—results pending; see its dated scope and evidence before interpreting any test plan as current access

• /posts/prompt-caching-agent-token-costs/ — Same-model token and accepted-result test protocol

• /compare/pi-vs-zcode-vs-opencode/

• /tools/pi/

• /tools/zcode/

• /models/glm-5.2/

• /tools/zai/

• /value/smart-spend/

Sources

• OpenCode repository and installation (Archive)
• OpenCode agents and permissions (Archive)
• OpenCode Zen models, pricing, and privacy — live page checked October 3, 2026; July 2 archive snapshot is historical
• TypeSafe AI privacy policy — retention policy linked by Zen for Jev
• NVIDIA API Trial Terms — trial terms linked by Zen; route-specific account behavior is unverified
• Meta Model API pricing and rate limits — direct API tier terms do not establish Zen account pricing
• Z.AI OpenCode integration (Archive)
• Z.AI supported Coding Plan tools (Archive)
• Z.AI Coding Plan usage policy (Archive)

Zen roster, model-specific data terms, and DeepSeek pricing pages checked on October 3, 2026. No account access, inference, quota, latency, or outcome was tested; the rest of the guide was not rechecked. Recheck the live terms before spending or sending proprietary code.