[opencode-agent]

When a provider.use policy denies a provider (for example a Console workspace with Managed providers only), the policy plugin removes it from the catalog without logging anything. The model then just fails with Model unavailable: ollama/..., and --log-level debug doesn't say why, which is how #56429 / #56453 turned into an A/B of the data directory.

This adds one debug line per catalog rebuild listing denied providers that were enabled (local discovery, config-declared, env credentials):

providers denied by policy providers=["ollama"]

Unconfigured models.dev catalog entries are skipped, so deny-all policies (enabled_providers, Managed providers only) don't log the whole catalog. No behavior change.

Requested by: @rekram1-node (Aiden Cline via Slack)

[opencode-agent]

The log line works, but with a realistic policy it is far too noisy. I ran opencode serve --print-logs from source on the base and on this branch, with a project config of { "enabled_providers": ["opencode"] }, and called opencode models once. The base logs nothing. This branch logs provider removed by policy 229 times, once for each models.dev catalog provider the policy denies.

enabled_providers and "Managed providers only" both deny * and then allow a few providers. providers.list() holds the whole catalog, not just configured or connected providers. Info is the default log level, so every user with such a policy gets hundreds of lines in their log file on each catalog rebuild (see inline comment).

Public API is unchanged: this only adds a log line.

bun test test/config/policy.test.ts passes (14/14) and bun run typecheck in packages/core is clean.