pullfrog 0.1.38 → 0.1.40

package/dist/agents/opencodeShared.d.ts

@@ -16,6 +16,43 @@ export type OpenCodeConfig = {
 export declare function geminiHighThinkingOverrides(): Record<string, {
     options: object;
 }>;
+/**
+ * Build the `provider.openrouter.models[id].options` map that pins every Kimi
+ * K2 OpenRouter alias away from the Enforcer-less providers via OpenRouter's
+ * `provider: {ignore:[...]}` routing directive. Sourced from the model registry
+ * so a Kimi alias/route change in `action/models.ts` flows through automatically.
+ *
+ * Wiring: the per-model `options` object merges into the request options
+ * (opencode `session/llm/request.ts` `mergeOptions(base, model.options)`),
+ * gets wrapped under `providerOptions.openrouter` (`provider/transform.ts`
+ * `sdkKey("@openrouter/ai-sdk-provider") === "openrouter"`), and the OpenRouter
+ * AI-SDK provider spreads everything under `providerOptions.openrouter` straight
+ * into the request body (`@openrouter/ai-sdk-provider` `doStream`/`doGenerate`),
+ * so `provider` lands as the top-level routing object OpenRouter expects.
+ */
+export declare function kimiOpenRouterProviderOverrides(): Record<string, {
+    options: object;
+}>;
+/**
+ * Build the `provider.openrouter.models[id].options` map that pins the
+ * efficient-tier DeepSeek model to high reasoning effort on the OpenRouter
+ * route — the funded/OSS default path. The shape must nest under `options`
+ * (opencode builds `Model.options` only from the entry's `options` sub-object —
+ * `provider.ts` `mergeDeep(existingModel.options, model.options)`) and use a
+ * `reasoning` record (the openrouter provider forwards only `usage`/`reasoning`/
+ * `promptCacheKey`); a bare `reasoningEffort` sibling is silently dropped.
+ * Sourced from the registry so a resolve bump carries the override forward.
+ * `high` is the ceiling OpenRouter's unified `reasoning.effort` exposes
+ * (low/medium/high); DeepSeek's native `max` is only reachable via a direct
+ * DeepSeek key, not the OpenRouter route.
+ */
+export declare function deepseekHighEffortOverrides(): Record<string, {
+    options: {
+        reasoning: {
+            effort: string;
+        };
+    };
+}>;
 /**
  * Read-only `reviewfrog` subagent for lens-based review. Non-mutative +
  * non-recursive — enforced by the system prompt in reviewer.ts.

package/dist/cli.mjs

@@ -101934,11 +101934,20 @@ var providers = {
     displayName: "Moonshot AI",
     envVars: ["MOONSHOT_API_KEY"],
     models: {
+      // Moonshot's premium 1M-context multimodal reasoning flagship — pricier
+      // than K2.7-code, so it's the preferred BYOK pick but NOT the subsidized
+      // efficient default (that stays K2 via AUTO_EFFICIENT).
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
       "kimi-k2": {
         displayName: "Kimi K2",
         resolve: "moonshotai/kimi-k2.7-code",
-        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code",
-        preferred: true
+        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       }
     }
   }),
@@ -102032,10 +102041,11 @@ var providers = {
         resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      // Zen serves m2.5; the funded OpenRouter path tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
         resolve: "opencode/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
@@ -102223,10 +102233,21 @@ var providers = {
         resolve: "openrouter/moonshotai/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "openrouter/moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3"
+      },
+      // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
-        resolve: "openrouter/minimax/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        resolve: "openrouter/minimax/minimax-m2.7",
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+      },
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "openrouter/minimax/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
   })
@@ -102275,7 +102296,7 @@ var modelAliases = Object.entries(providers).flatMap(
 var AUTO_EFFICIENT = "auto/efficient";
 var AUTO_INTELLIGENT = "auto/intelligent";
 var AUTO_TIER_TARGET = {
-  [AUTO_EFFICIENT]: "moonshotai/kimi-k2",
+  [AUTO_EFFICIENT]: "deepseek/deepseek-pro",
   [AUTO_INTELLIGENT]: "anthropic/claude-opus"
 };
 function isAutoTier(slug2) {
@@ -102473,7 +102494,7 @@ async function preflightClaudeSubscription(params) {
   } catch {
     return { usable: true };
   }
-  if (res.status !== 401 && res.status !== 429) return { usable: true };
+  if (res.status !== 401 && res.status !== 403 && res.status !== 429) return { usable: true };
   const body = await res.text().catch(() => "");
   return { usable: false, reason: `${res.status}: ${extractApiErrorMessage(body)}` };
 }
@@ -102976,7 +102997,7 @@ function extractExcerpt(text, matchIndex) {
   }
   return excerpt.trim();
 }
-var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford/is;
+var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford|Key limit exceeded \(total limit\)/is;
 function isRouterKeylimitExhaustedError(text) {
   return ROUTER_KEYLIMIT_EXHAUSTED_PATTERN.test(text);
 }
@@ -103001,7 +103022,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.38",
+  version: "0.1.40",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -110227,6 +110248,19 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
+function kimiOpenRouterProviderOverrides() {
+  return Object.fromEntries(
+    modelAliases.map((a) => a.openRouterResolve).filter((r) => r?.includes("kimi") ?? false).map((r) => [
+      r.replace(/^openrouter\//, ""),
+      { options: { provider: { ignore: KIMI_ENFORCERLESS_PROVIDERS } } }
+    ])
+  );
+}
+function deepseekHighEffortOverrides() {
+  const orModel = modelAliases.find((a) => a.slug === "deepseek/deepseek-pro")?.openRouterResolve?.replace(/^openrouter\//, "");
+  return orModel ? { [orModel]: { options: { reasoning: { effort: "high" } } } } : {};
+}
 function buildReviewerAgentConfig(orchestratorModel) {
   const overrides = deriveSubagentModels(orchestratorModel);
   return {
@@ -110295,9 +110329,18 @@ function buildSecurityConfig(ctx, model) {
       log.info(`\xBB subagent models: reviewfrog=${reviewerModel}`);
       return cfg;
     })(),
-    // gemini-3 thinking pinned to high for review depth; gpt and anthropic
-    // effort set elsewhere (gpt: upstream default, anthropic: --effort flag in claude.ts).
-    provider: { google: { models: geminiHighThinkingOverrides() } }
+    // gemini-3 thinking pinned to high for review depth; deepseek (funded
+    // efficient tier) pinned to high reasoning effort, and kimi pinned away
+    // from Enforcer-less openrouter providers (siliconflow / together) that
+    // drop optional tool-call params — both per-model on the openrouter route,
+    // so other models are unaffected. gpt/anthropic effort set elsewhere (gpt:
+    // upstream default, anthropic: --effort flag in claude.ts). see opencodeShared.ts.
+    provider: {
+      google: { models: geminiHighThinkingOverrides() },
+      openrouter: {
+        models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
+      }
+    }
   };
   if (model) {
     config3.model = model;
@@ -110423,7 +110466,6 @@ function newTurn() {
     finalText: "",
     tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
-    sessionError: null,
     lastToolError: null
   };
 }
@@ -110454,7 +110496,6 @@ async function dispatchEvent(ctx, event) {
     if (sessionID !== ctx.orchestratorSessionID) return;
     const err = event.properties.error;
     const message = err ? extractErrorMessage(err) : "(no error payload)";
-    if (ctx.currentTurn) ctx.currentTurn.sessionError = message;
     log.info(`\xBB ${ctx.label} session error: ${message}`);
     return;
   }
@@ -110647,14 +110688,6 @@ async function runPromptTurn(ctx, params) {
       usage
     };
   }
-  if (turn.sessionError) {
-    return {
-      success: false,
-      output: finalText,
-      error: `session error: ${turn.sessionError}`,
-      usage
-    };
-  }
   return { success: true, output: finalText, usage };
 }
 async function aggregateTurnUsage(ctx, turnStartMs) {
@@ -164672,10 +164705,13 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isClaudeSubscriptionDisabledError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
-  return /authentication token has expired/i.test(text) || /Token refresh failed/i.test(text);
+  return /authentication token has (expired|been invalidated)/i.test(text) || /OAuth access token has expired/i.test(text) || /Token refresh failed/i.test(text);
+}
+function isClaudeSubscriptionDisabledError(text) {
+  return /disabled Claude subscription access/i.test(text);
 }
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
@@ -164684,11 +164720,18 @@ function formatApiKeyErrorSummary(params) {
   }
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  if (isClaudeSubscriptionDisabledError(params.raw)) {
+    return [
+      `**Your organization has disabled Claude subscription access for Claude Code.** Ask your Claude organization's admin to re-enable it in the Claude Console, or set an \`ANTHROPIC_API_KEY\` for this repo instead, then re-trigger the run.`,
+      "",
+      `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
-      `**Your provider OAuth credential has expired.** Re-authenticate the provider connection (e.g. \`pullfrog auth codex\`), then re-trigger the run.`,
+      `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\`), then re-trigger the run.`,
       "",
-      `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+      `[Claude subscription \u2192](https://docs.pullfrog.com/claude-auth) \xB7 [ChatGPT subscription \u2192](https://docs.pullfrog.com/codex-auth) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
   return [
@@ -168474,7 +168517,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.38";
+var VERSION10 = "0.1.40";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -100005,11 +100005,20 @@ var providers = {
     displayName: "Moonshot AI",
     envVars: ["MOONSHOT_API_KEY"],
     models: {
+      // Moonshot's premium 1M-context multimodal reasoning flagship — pricier
+      // than K2.7-code, so it's the preferred BYOK pick but NOT the subsidized
+      // efficient default (that stays K2 via AUTO_EFFICIENT).
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
       "kimi-k2": {
         displayName: "Kimi K2",
         resolve: "moonshotai/kimi-k2.7-code",
-        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code",
-        preferred: true
+        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       }
     }
   }),
@@ -100103,10 +100112,11 @@ var providers = {
         resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      // Zen serves m2.5; the funded OpenRouter path tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
         resolve: "opencode/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
@@ -100294,10 +100304,21 @@ var providers = {
         resolve: "openrouter/moonshotai/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "openrouter/moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3"
+      },
+      // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
-        resolve: "openrouter/minimax/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        resolve: "openrouter/minimax/minimax-m2.7",
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+      },
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "openrouter/minimax/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
   })
@@ -100346,7 +100367,7 @@ var modelAliases = Object.entries(providers).flatMap(
 var AUTO_EFFICIENT = "auto/efficient";
 var AUTO_INTELLIGENT = "auto/intelligent";
 var AUTO_TIER_TARGET = {
-  [AUTO_EFFICIENT]: "moonshotai/kimi-k2",
+  [AUTO_EFFICIENT]: "deepseek/deepseek-pro",
   [AUTO_INTELLIGENT]: "anthropic/claude-opus"
 };
 function isAutoTier(slug2) {
@@ -100544,7 +100565,7 @@ async function preflightClaudeSubscription(params) {
   } catch {
     return { usable: true };
   }
-  if (res.status !== 401 && res.status !== 429) return { usable: true };
+  if (res.status !== 401 && res.status !== 403 && res.status !== 429) return { usable: true };
   const body = await res.text().catch(() => "");
   return { usable: false, reason: `${res.status}: ${extractApiErrorMessage(body)}` };
 }
@@ -101047,7 +101068,7 @@ function extractExcerpt(text, matchIndex) {
   }
   return excerpt.trim();
 }
-var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford/is;
+var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford|Key limit exceeded \(total limit\)/is;
 function isRouterKeylimitExhaustedError(text) {
   return ROUTER_KEYLIMIT_EXHAUSTED_PATTERN.test(text);
 }
@@ -101072,7 +101093,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.38",
+  version: "0.1.40",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -108340,6 +108361,19 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
+function kimiOpenRouterProviderOverrides() {
+  return Object.fromEntries(
+    modelAliases.map((a) => a.openRouterResolve).filter((r) => r?.includes("kimi") ?? false).map((r) => [
+      r.replace(/^openrouter\//, ""),
+      { options: { provider: { ignore: KIMI_ENFORCERLESS_PROVIDERS } } }
+    ])
+  );
+}
+function deepseekHighEffortOverrides() {
+  const orModel = modelAliases.find((a) => a.slug === "deepseek/deepseek-pro")?.openRouterResolve?.replace(/^openrouter\//, "");
+  return orModel ? { [orModel]: { options: { reasoning: { effort: "high" } } } } : {};
+}
 function buildReviewerAgentConfig(orchestratorModel) {
   const overrides = deriveSubagentModels(orchestratorModel);
   return {
@@ -108408,9 +108442,18 @@ function buildSecurityConfig(ctx, model) {
       log.info(`\xBB subagent models: reviewfrog=${reviewerModel}`);
       return cfg;
     })(),
-    // gemini-3 thinking pinned to high for review depth; gpt and anthropic
-    // effort set elsewhere (gpt: upstream default, anthropic: --effort flag in claude.ts).
-    provider: { google: { models: geminiHighThinkingOverrides() } }
+    // gemini-3 thinking pinned to high for review depth; deepseek (funded
+    // efficient tier) pinned to high reasoning effort, and kimi pinned away
+    // from Enforcer-less openrouter providers (siliconflow / together) that
+    // drop optional tool-call params — both per-model on the openrouter route,
+    // so other models are unaffected. gpt/anthropic effort set elsewhere (gpt:
+    // upstream default, anthropic: --effort flag in claude.ts). see opencodeShared.ts.
+    provider: {
+      google: { models: geminiHighThinkingOverrides() },
+      openrouter: {
+        models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
+      }
+    }
   };
   if (model) {
     config3.model = model;
@@ -108536,7 +108579,6 @@ function newTurn() {
     finalText: "",
     tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
-    sessionError: null,
     lastToolError: null
   };
 }
@@ -108567,7 +108609,6 @@ async function dispatchEvent(ctx, event) {
     if (sessionID !== ctx.orchestratorSessionID) return;
     const err = event.properties.error;
     const message = err ? extractErrorMessage(err) : "(no error payload)";
-    if (ctx.currentTurn) ctx.currentTurn.sessionError = message;
     log.info(`\xBB ${ctx.label} session error: ${message}`);
     return;
   }
@@ -108760,14 +108801,6 @@ async function runPromptTurn(ctx, params) {
       usage
     };
   }
-  if (turn.sessionError) {
-    return {
-      success: false,
-      output: finalText,
-      error: `session error: ${turn.sessionError}`,
-      usage
-    };
-  }
   return { success: true, output: finalText, usage };
 }
 async function aggregateTurnUsage(ctx, turnStartMs) {
@@ -162785,10 +162818,13 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isClaudeSubscriptionDisabledError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
-  return /authentication token has expired/i.test(text) || /Token refresh failed/i.test(text);
+  return /authentication token has (expired|been invalidated)/i.test(text) || /OAuth access token has expired/i.test(text) || /Token refresh failed/i.test(text);
+}
+function isClaudeSubscriptionDisabledError(text) {
+  return /disabled Claude subscription access/i.test(text);
 }
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
@@ -162797,11 +162833,18 @@ function formatApiKeyErrorSummary(params) {
   }
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  if (isClaudeSubscriptionDisabledError(params.raw)) {
+    return [
+      `**Your organization has disabled Claude subscription access for Claude Code.** Ask your Claude organization's admin to re-enable it in the Claude Console, or set an \`ANTHROPIC_API_KEY\` for this repo instead, then re-trigger the run.`,
+      "",
+      `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
-      `**Your provider OAuth credential has expired.** Re-authenticate the provider connection (e.g. \`pullfrog auth codex\`), then re-trigger the run.`,
+      `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\`), then re-trigger the run.`,
       "",
-      `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+      `[Claude subscription \u2192](https://docs.pullfrog.com/claude-auth) \xB7 [ChatGPT subscription \u2192](https://docs.pullfrog.com/codex-auth) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
   return [

package/dist/internal.js

@@ -196,11 +196,20 @@ var providers = {
     displayName: "Moonshot AI",
     envVars: ["MOONSHOT_API_KEY"],
     models: {
+      // Moonshot's premium 1M-context multimodal reasoning flagship — pricier
+      // than K2.7-code, so it's the preferred BYOK pick but NOT the subsidized
+      // efficient default (that stays K2 via AUTO_EFFICIENT).
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
       "kimi-k2": {
         displayName: "Kimi K2",
         resolve: "moonshotai/kimi-k2.7-code",
-        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code",
-        preferred: true
+        openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       }
     }
   }),
@@ -294,10 +303,11 @@ var providers = {
         resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      // Zen serves m2.5; the funded OpenRouter path tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
         resolve: "opencode/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
@@ -485,10 +495,21 @@ var providers = {
         resolve: "openrouter/moonshotai/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "openrouter/moonshotai/kimi-k3",
+        openRouterResolve: "openrouter/moonshotai/kimi-k3"
+      },
+      // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
-        resolve: "openrouter/minimax/minimax-m2.5",
-        openRouterResolve: "openrouter/minimax/minimax-m2.5"
+        resolve: "openrouter/minimax/minimax-m2.7",
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+      },
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "openrouter/minimax/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
   })
@@ -546,7 +567,7 @@ var modelAliases = Object.entries(providers).flatMap(
 var AUTO_EFFICIENT = "auto/efficient";
 var AUTO_INTELLIGENT = "auto/intelligent";
 var AUTO_TIER_TARGET = {
-  [AUTO_EFFICIENT]: "moonshotai/kimi-k2",
+  [AUTO_EFFICIENT]: "deepseek/deepseek-pro",
   [AUTO_INTELLIGENT]: "anthropic/claude-opus"
 };
 function isAutoTier(slug) {

package/dist/models.d.ts

@@ -121,9 +121,11 @@ export declare const modelAliases: ModelAlias[];
  * concrete alias by `resolveDisplayAlias` below, so every downstream consumer
  * (CLI resolve, OpenRouter resolve, footer label) handles them transparently.
  *
- * `efficient` mirrors the OSS/default subsidy model (Kimi K2 — fast + cheap);
- * `intelligent` is the frontier pick (Claude Opus). a `null` model means the
- * tier hasn't been pinned: callers default by card status via `defaultAutoTier`.
+ * `efficient` mirrors the OSS/default subsidy model (DeepSeek V4 Pro — beats
+ * Kimi K2.7 on agentic-review quality at ~4-5x lower cost, run at high
+ * reasoning effort via `deepseekHighEffortOverrides`); `intelligent` is the
+ * frontier pick (Claude Opus). a `null` model means the tier hasn't been
+ * pinned: callers default by card status via `defaultAutoTier`.
  */
 export declare const AUTO_EFFICIENT = "auto/efficient";
 export declare const AUTO_INTELLIGENT = "auto/intelligent";

package/dist/utils/apiKeys.d.ts

@@ -37,6 +37,9 @@ export declare function validateAgentApiKey(params: {
  *     ****XXXX is invalid`. anchored to "Your api key: ... is invalid" so it
  *     can't collide with DeepSeek's already-handled `Insufficient balance`
  *     billing shape (which routes to formatProviderBillingExhausted).
+ *   - org-disabled Claude subscription (#1072): `Your organization has
+ *     disabled Claude subscription access for Claude Code`, an entitlement
+ *     denial with its own remedy — see isClaudeSubscriptionDisabledError.
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**
@@ -46,8 +49,17 @@ export declare function isApiKeyAuthError(text: string): boolean;
  * distinct copy for these. Patterns are deliberately narrow:
  * "authentication token has expired" (not bare "token has expired") so a
  * GitHub installation-token expiry can't be misread as an LLM key problem.
+ * also covers server-side revocation ("authentication token has been
+ * invalidated", OpenAI `token_invalidated`, #1041) and the Claude CLI's
+ * "OAuth access token has expired" phrasing (#1072) — same remediation.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
+/**
+ * Anthropic entitlement denial for Claude Pro/Max subscription auth (#1072):
+ * an org admin turned off Claude Code subscription access. no credential the
+ * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
+ */
+export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/claudeSubscription.d.ts

@@ -16,7 +16,9 @@ export type SubscriptionPreflight = {
  * per-model ("You've hit your Opus limit"), so a cheaper stand-in could pass
  * preflight and still leave the run dead on arrival.
  *
- * fail-open by design: only 401 (revoked/expired token) and 429
+ * fail-open by design: only 401 (revoked/expired token), 403 (Anthropic
+ * `permission_error` — the credential isn't entitled to serve this run, e.g.
+ * an org disabled Claude Code subscription access, #1072) and 429
  * (session/weekly/per-model limit) mark the token unusable. network errors,
  * 5xx, and request-shape drift (400) all keep today's subscription-first
  * behavior, so the preflight can never fail a run that would have worked —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",