[FEATURE]: [V2] Add Model Allowlisting Support

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Summary

OpenCode V2 currently provides a clean way to restrict providers through provider.use policies, but there is no equivalent mechanism to restrict which models are allowed.

For centrally managed environments, we need a way to configure OpenCode so that only explicitly approved models are available.

Problem

Today, unwanted models can be disabled individually:

{
  "providers": {
    "opencode-go": {
      "models": {
        "model-a": {
          "disabled": true
        },
        "model-b": {
          "disabled": true
        }
      }
    }
  }
}

This is effectively a denylist.

The problem is that providers and model catalogs can change over time. If a provider exposes a new model, it may become available automatically until an administrator explicitly disables it.

For managed deployments, the desired behavior is:

New models should be blocked by default until explicitly approved.

Proposed Solution

Extend the V2 policy system with a model.use action, similar to provider.use.

Example:

{
  "experimental": {
    "policies": [
      {
        "effect": "deny",
        "action": "model.use",
        "resource": "*"
      },
      {
        "effect": "allow",
        "action": "model.use",
        "resource": "requesty/deepseek-v4-pro-0813"
      },
      {
        "effect": "allow",
        "action": "model.use",
        "resource": "requesty/gpt-5.6-luna"
      },
      {
        "effect": "allow",
        "action": "model.use",
        "resource": "opencode-go/glm-5.3"
      }
    ]
  }
}

Wildcard support would also be useful:

{
  "effect": "allow",
  "action": "model.use",
  "resource": "requesty/*"
}

Expected Behavior

When model policies are configured:

• Only explicitly allowed models appear in the model selector.
• Disallowed models cannot be selected via agents, commands, config files, or direct model IDs.
• Newly discovered models remain unavailable by default.
• System/global restrictions cannot be bypassed by workspace or user configuration.

Why This Matters

This is important for organizations that centrally manage OpenCode and need control over:

• cost
• privacy / ZDR requirements
• data residency
• compliance
• model quality
• rollout/testing policies
• approved providers and contracts

A default-deny + explicit-allow model policy would make model governance much safer and easier than maintaining an ever-growing blacklist.

Since V2 already has provider.use, adding model.use would also make provider and model access control consistent.