pullfrog 0.1.46 → 0.1.48

package/dist/cli.mjs

@@ -101356,6 +101356,10 @@ async function setPullfrogSecret(ctx) {
   }
   return { saved: false, error: result.data.error || `api returned ${result.status}` };
 }
+function describeSecretTarget(ctx) {
+  if (ctx.scope === "account") return `account ${import_picocolors.default.cyan(`@${ctx.owner}`)}`;
+  return `repo ${import_picocolors.default.cyan(`${ctx.owner}/${ctx.repo}`)}`;
+}
 async function promptScope(ctx) {
   const scope2 = await _t({
     message: "secret scope",
@@ -101579,7 +101583,8 @@ async function runCodexAuth() {
       O2.warn(err instanceof Error ? err.message : String(err));
       savable = auth2;
     }
-    spin.start(`saving ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to Pullfrog`);
+    const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
+    spin.start(`saving ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
     const result = await setPullfrogSecret({
       token,
       owner: remote.owner,
@@ -101596,7 +101601,7 @@ async function runCodexAuth() {
       );
       process.exit(1);
     }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to Pullfrog (${scope2})`);
+    spin.stop(`saved ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
     setActiveSpin(null);
     gt("done.");
   } catch (error49) {
@@ -101693,7 +101698,8 @@ async function runClaudeAuth() {
         `that doesn't look like a ${import_picocolors2.default.cyan("claude setup-token")} token (expected ${import_picocolors2.default.cyan(`${CLAUDE_OAUTH_TOKEN_PREFIX}\u2026`)}). saving it anyway.`
       );
     }
-    spin.start(`saving ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to Pullfrog`);
+    const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
+    spin.start(`saving ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
     const result = await setPullfrogSecret({
       token,
       owner: remote.owner,
@@ -101710,7 +101716,7 @@ async function runClaudeAuth() {
       );
       process.exit(1);
     }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to Pullfrog (${scope2})`);
+    spin.stop(`saved ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
     setActiveSpin(null);
     gt("done.");
   } catch (error49) {
@@ -101738,6 +101744,36 @@ import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writ
 import { join as join5 } from "node:path";
 import { performance as performance5 } from "node:perf_hooks";
 
+// effort.ts
+var DEFAULT_EFFORT_POSITION = 0.75;
+var EFFORT_ALIASES = {
+  low: 0,
+  medium: 0.25,
+  high: 0.5,
+  xhigh: 0.75,
+  max: 1
+};
+var DISABLING_RUNGS = ["none", "minimal"];
+function isEffortPosition(value2) {
+  return Number.isFinite(value2) && value2 >= 0 && value2 <= 1;
+}
+function parseEffortPosition(raw2) {
+  const normalized = raw2.trim().toLowerCase();
+  const named = EFFORT_ALIASES[normalized === "med" ? "medium" : normalized];
+  if (named !== void 0) return named;
+  const numeric = Number(normalized);
+  return normalized !== "" && isEffortPosition(numeric) ? numeric : void 0;
+}
+function offeredRungs(published) {
+  return published.filter((rung) => !DISABLING_RUNGS.includes(rung));
+}
+function resolveRung(params) {
+  const rungs = offeredRungs(params.published);
+  if (rungs.length === 0) return void 0;
+  const clamped = Math.min(1, Math.max(0, params.position));
+  return rungs[Math.floor(clamped * (rungs.length - 1))];
+}
+
 // models.ts
 function provider(config3) {
   return config3;
@@ -101757,6 +101793,7 @@ var providers = {
       "claude-fable": {
         displayName: "Claude Fable",
         resolve: "anthropic/claude-fable-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         // rolling alias: models.dev's OpenRouter mirror lags brand-new pinned
         // versions (claude-fable-5 isn't indexed yet), so track ~…-latest to
         // stay catalog-valid and auto-follow version bumps.
@@ -101766,6 +101803,7 @@ var providers = {
       "claude-opus": {
         displayName: "Claude Opus",
         resolve: "anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-opus-5",
         preferred: true,
         subagentModel: "claude-sonnet"
@@ -101773,6 +101811,7 @@ var providers = {
       "claude-sonnet": {
         displayName: "Claude Sonnet",
         resolve: "anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-sonnet-5"
       },
       "claude-haiku": {
@@ -101790,6 +101829,7 @@ var providers = {
       gpt: {
         displayName: "GPT Sol",
         resolve: "openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         preferred: true,
         subagentModel: "gpt-terra"
@@ -101801,6 +101841,7 @@ var providers = {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
         subagentModel: "gpt"
       },
@@ -101810,11 +101851,13 @@ var providers = {
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
       "gpt-mini": {
         displayName: "GPT Luna",
         resolve: "openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-luna"
       },
       // legacy aliases — openai unified the codex line into the main GPT family
@@ -101844,6 +101887,7 @@ var providers = {
       o3: {
         displayName: "O3",
         resolve: "openai/o3",
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/openai/o3"
       }
     }
@@ -101855,6 +101899,7 @@ var providers = {
       "gemini-pro": {
         displayName: "Gemini Pro",
         resolve: "google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/google/gemini-3.1-pro-preview",
         preferred: true
         // Inherit (subagents stay on Pro). Google has no in-between tier;
@@ -101866,6 +101911,7 @@ var providers = {
       "gemini-flash": {
         displayName: "Gemini Flash",
         resolve: "google/gemini-3.5-flash",
+        effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/google/gemini-3.5-flash"
       }
     }
@@ -101877,6 +101923,7 @@ var providers = {
       grok: {
         displayName: "Grok",
         resolve: "xai/grok-4.3",
+        effort: ["none", "low", "medium", "high"],
         openRouterResolve: "openrouter/x-ai/grok-4.3",
         preferred: true
       },
@@ -101906,12 +101953,16 @@ var providers = {
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "deepseek/deepseek-v4-pro",
+        effort: ["high", "max"],
+        openRouterEffort: ["high", "xhigh"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro",
         preferred: true
       },
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-v4-flash",
+        effort: ["high", "max"],
+        openRouterEffort: ["high", "xhigh"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
       },
       // legacy aliases — deepseek retires these on 2026-07-24; transparently
@@ -101940,6 +101991,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         resolve: "moonshotai/kimi-k3",
+        effort: ["low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3",
         preferred: true,
         subagentModel: "kimi-k2"
@@ -101952,7 +102004,7 @@ var providers = {
     }
   }),
   opencode: provider({
-    displayName: "OpenCode",
+    displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
     models: {
       "big-pickle": {
@@ -101965,12 +102017,14 @@ var providers = {
       "claude-opus": {
         displayName: "Claude Opus",
         resolve: "opencode/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-opus-5",
         subagentModel: "claude-sonnet"
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
         resolve: "opencode/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-sonnet-5"
       },
       "claude-haiku": {
@@ -101981,6 +102035,7 @@ var providers = {
       gpt: {
         displayName: "GPT Sol",
         resolve: "opencode/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
@@ -101989,6 +102044,7 @@ var providers = {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "opencode/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
         subagentModel: "gpt"
       },
@@ -101996,11 +102052,13 @@ var providers = {
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "opencode/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
       "gpt-mini": {
         displayName: "GPT Luna",
         resolve: "opencode/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-luna"
       },
       // legacy aliases — see openai provider above for context.
@@ -102026,12 +102084,14 @@ var providers = {
       "gemini-pro": {
         displayName: "Gemini Pro",
         resolve: "opencode/gemini-3.1-pro",
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/google/gemini-3.1-pro-preview"
         // Inherit — see google/gemini-pro for rationale.
       },
       "gemini-flash": {
         displayName: "Gemini Flash",
         resolve: "opencode/gemini-3.5-flash",
+        effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/google/gemini-3.5-flash"
       },
       "kimi-k2": {
@@ -102050,6 +102110,7 @@ var providers = {
       "gpt-5-nano": {
         displayName: "GPT Nano",
         resolve: "opencode/gpt-5-nano",
+        effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/openai/gpt-5-nano"
       },
       "mimo-v2-pro-free": {
@@ -102076,6 +102137,8 @@ var providers = {
       "glm-5.1": {
         displayName: "GLM 5.2",
         resolve: "opencode-go/glm-5.2",
+        effort: ["high", "max"],
+        openRouterEffort: ["high", "xhigh"],
         openRouterResolve: "openrouter/z-ai/glm-5.2",
         preferred: true
       },
@@ -102129,6 +102192,10 @@ var providers = {
     // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
     // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
     // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    // the two token limits are deliberately absent: this list is the auth
+    // heuristic (`hasPullfrogStoredAuthForModel`, `validateAgentApiKey`), and a
+    // stored context number is config, not proof of a key. the console picks
+    // them up from `PROVIDER_EXTRA_SECRET_NAMES` instead.
     envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
     models: {
       // single routing entry — the actual model ID is read from
@@ -102148,6 +102215,7 @@ var providers = {
       "claude-opus": {
         displayName: "Claude Opus",
         resolve: "openrouter/~anthropic/claude-opus-latest",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/~anthropic/claude-opus-latest",
         preferred: true,
         subagentModel: "claude-sonnet"
@@ -102155,6 +102223,7 @@ var providers = {
       "claude-sonnet": {
         displayName: "Claude Sonnet",
         resolve: "openrouter/~anthropic/claude-sonnet-latest",
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/~anthropic/claude-sonnet-latest"
       },
       "claude-haiku": {
@@ -102169,6 +102238,7 @@ var providers = {
       gpt: {
         displayName: "GPT Sol",
         resolve: "openrouter/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
@@ -102177,6 +102247,7 @@ var providers = {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openrouter/openai/gpt-5.6-sol-pro",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
         subagentModel: "gpt"
       },
@@ -102184,11 +102255,13 @@ var providers = {
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openrouter/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
       "gpt-mini": {
         displayName: "GPT Luna",
         resolve: "openrouter/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-luna"
       },
       // legacy aliases — see openai provider for context.
@@ -102214,32 +102287,38 @@ var providers = {
       "o4-mini": {
         displayName: "O4 Mini",
         resolve: "openrouter/openai/o4-mini",
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/openai/o4-mini"
       },
       "gemini-pro": {
         displayName: "Gemini Pro",
         resolve: "openrouter/~google/gemini-pro-latest",
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/~google/gemini-pro-latest"
         // Inherit — see google/gemini-pro for rationale.
       },
       "gemini-flash": {
         displayName: "Gemini Flash",
         resolve: "openrouter/~google/gemini-flash-latest",
+        effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/~google/gemini-flash-latest"
       },
       grok: {
         displayName: "Grok",
         resolve: "openrouter/x-ai/grok-4.3",
+        effort: ["none", "low", "medium", "high"],
         openRouterResolve: "openrouter/x-ai/grok-4.3"
       },
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "openrouter/deepseek/deepseek-v4-pro",
+        effort: ["high", "xhigh"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro"
       },
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "openrouter/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
       },
       // legacy alias — deepseek retires this on 2026-07-24; transparently
@@ -102258,6 +102337,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         resolve: "openrouter/moonshotai/kimi-k3",
+        effort: ["low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3"
       },
       // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
@@ -102312,6 +102392,8 @@ var modelAliases = Object.entries(providers).flatMap(
     // here to a fully-qualified slug so callers can look up the target alias
     // directly without re-deriving the provider.
     subagentModel: def.subagentModel ? `${providerKey}/${def.subagentModel}` : void 0,
+    effort: def.effort,
+    openRouterEffort: def.openRouterEffort,
     hidden: def.hidden ?? false
   }))
 );
@@ -102350,6 +102432,17 @@ function resolveCliModel(slug2) {
 function resolveOpenRouterModel(slug2) {
   return resolveDisplayAlias(slug2)?.openRouterResolve;
 }
+function getModelEffortLevels(params) {
+  const alias = resolveDisplayAlias(params.slug);
+  if (!alias) return void 0;
+  if (params.useOpenRouter) return alias.openRouterEffort ?? alias.effort;
+  return alias.effort;
+}
+function resolveModelRung(params) {
+  const published = getModelEffortLevels(params);
+  if (!published) return void 0;
+  return resolveRung({ position: params.position, published });
+}
 var defaultProxyAlias = resolveDisplayAlias(AUTO_EFFICIENT);
 if (!defaultProxyAlias?.openRouterResolve) {
   throw new Error(`DEFAULT_PROXY_MODEL: ${AUTO_EFFICIENT} has no openRouterResolve`);
@@ -103037,6 +103130,40 @@ function extractProviderId(text) {
   return match3 ? match3[1].toLowerCase() : null;
 }
 
+// utils/runEffort.ts
+function matchHostedAnthropicAlias(modelId) {
+  const id = modelId.toLowerCase();
+  if (id.startsWith("arn:")) return void 0;
+  return modelAliases.find(
+    (a) => !a.fallback && a.provider === "anthropic" && id.includes(a.resolve.replace(/^anthropic\//, ""))
+  );
+}
+function resolveRunAlias(ctx) {
+  const proxyModel = ctx.payload.proxyModel;
+  if (proxyModel) {
+    return modelAliases.find((a) => !a.fallback && a.openRouterResolve === proxyModel);
+  }
+  const model = ctx.resolvedModel;
+  if (!model) return void 0;
+  return modelAliases.find((a) => !a.fallback && a.resolve === model) ?? matchHostedAnthropicAlias(model);
+}
+function resolveRunEffort(ctx) {
+  const configured = ctx.payload.effort !== void 0;
+  const position = ctx.payload.effort ?? DEFAULT_EFFORT_POSITION;
+  const alias = resolveRunAlias(ctx);
+  if (!alias) return { position, configured, rung: void 0, alias: void 0 };
+  return {
+    position,
+    configured,
+    rung: resolveModelRung({
+      slug: alias.slug,
+      position,
+      useOpenRouter: !!ctx.payload.proxyModel
+    }),
+    alias
+  };
+}
+
 // utils/skills.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
@@ -103050,7 +103177,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.46",
+  version: "0.1.48",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -104610,8 +104737,18 @@ function stripProviderPrefix(specifier) {
   const slashIndex = specifier.indexOf("/");
   return slashIndex > 0 ? specifier.slice(slashIndex + 1) : specifier;
 }
-function resolveEffort(_model) {
-  return "high";
+var CLAUDE_EFFORT_ENV = "CLAUDE_CODE_EFFORT_LEVEL";
+var CLAUDE_CODE_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+function effortCapabilities(levels) {
+  const topRungs = levels.filter((l) => l === "xhigh" || l === "max").map((l) => `${l}_effort`);
+  return ["effort", ...topRungs, "adaptive_thinking", "thinking"].join(",");
+}
+function applyHostedEffortCapabilities(params) {
+  params.env.ANTHROPIC_MODEL ||= params.modelId;
+  params.env.ANTHROPIC_CUSTOM_MODEL_OPTION ||= params.modelId;
+  params.env.ANTHROPIC_CUSTOM_MODEL_OPTION_SUPPORTED_CAPABILITIES ||= effortCapabilities(
+    params.levels
+  );
 }
 function tailLines2(text, maxCodeUnits) {
   if (text.length <= maxCodeUnits) return text;
@@ -105087,7 +105224,7 @@ var claude = agent({
       });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
-      const effort = resolveEffort(model);
+      const effort = resolveRunEffort(ctx);
       const pretoolGate = writePretoolGateAssets(ctx);
       const stopHookPath = join5(ctx.tmpdir, "pullfrog-stop-hook.sh");
       writeFileSync4(stopHookPath, buildStopHookScript(), { mode: 493 });
@@ -105101,13 +105238,16 @@ var claude = agent({
         "--settings",
         pretoolGate.settingsPath,
         "--verbose",
-        "--effort",
-        effort,
         "--disallowedTools",
         CLAUDE_DISALLOWED_TOOLS,
         "--agents",
         buildAgentsJson()
       ];
+      if (effort.rung && !CLAUDE_CODE_EFFORTS.includes(effort.rung)) {
+        log.warning(`\xBB effort ${effort.rung} not sent \u2014 claude-code doesn't accept that level`);
+      } else if (effort.rung) {
+        baseArgs.push("--effort", effort.rung);
+      }
       if (model) {
         baseArgs.push("--model", model);
       }
@@ -105125,6 +105265,9 @@ var claude = agent({
         applyClaudeVertexEnv(env2);
         env2.ANTHROPIC_MODEL = specifier;
       }
+      if ((isBedrockRoute || isVertexRoute2) && specifier && effort.alias?.effort) {
+        applyHostedEffortCapabilities({ env: env2, modelId: specifier, levels: effort.alias.effort });
+      }
       if (env2.CLAUDE_CODE_OAUTH_TOKEN && !isBedrockRoute && env2.ANTHROPIC_API_KEY) {
         const preflight = await preflightClaudeSubscription({
           token: env2.CLAUDE_CODE_OAUTH_TOKEN,
@@ -105142,7 +105285,12 @@ var claude = agent({
           delete env2.CLAUDE_CODE_OAUTH_TOKEN;
         }
       }
-      log.info(`\xBB effort: ${effort}`);
+      const effortEnvOverride = env2[CLAUDE_EFFORT_ENV]?.trim();
+      if (effortEnvOverride) {
+        log.warning(
+          `\xBB ${CLAUDE_EFFORT_ENV}=${effortEnvOverride} in the run env overrides the effort setting for this session`
+        );
+      }
       log.debug(`\xBB starting Pullfrog (Claude Code): ${cliPath} ${baseArgs.join(" ")}`);
       log.debug(`\xBB working directory: ${repoDir}`);
       const gateServer = __using(_stack, await startGateServer(ctx), true);
@@ -105166,7 +105314,7 @@ var claude = agent({
   }
 });
 
-// agents/opencode_v2.ts
+// agents/opencode.ts
 var core2 = __toESM(require_core(), 1);
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
@@ -110576,7 +110724,7 @@ function createOpencodeClient(config3) {
 // node_modules/.pnpm/@opencode-ai+sdk@1.18.5/node_modules/@opencode-ai/sdk/dist/v2/server.js
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 
-// agents/opencode_v2.ts
+// agents/opencode.ts
 var import_undici = __toESM(require_undici2(), 1);
 
 // utils/codexHome.ts
@@ -110849,14 +110997,6 @@ function deriveSubagentModels(orchestratorSpec) {
 }
 
 // agents/opencodeShared.ts
-function geminiHighThinkingOverrides() {
-  return Object.fromEntries(
-    modelAliases.filter((a) => a.provider === "google").map((a) => [
-      a.resolve.replace(/^google\//, ""),
-      { options: { thinkingConfig: { thinkingLevel: "high" } } }
-    ])
-  );
-}
 function openAICompatibleLimit() {
   return {
     context: Number(process.env[OPENAI_COMPATIBLE_CONTEXT_ENV]),
@@ -110889,10 +111029,6 @@ function kimiOpenRouterProviderOverrides() {
     ])
   );
 }
-function deepseekHighEffortOverrides() {
-  const orModel = modelAliases.find((a) => a.slug === "deepseek/deepseek-pro")?.openRouterResolve?.replace(/^openrouter\//, "");
-  return orModel ? { [orModel]: { options: { reasoning: { effort: "high" } } } } : {};
-}
 function buildReviewerAgentConfig(orchestratorModel) {
   const overrides = deriveSubagentModels(orchestratorModel);
   return {
@@ -110934,7 +111070,7 @@ function autoSelectModel() {
   return void 0;
 }
 
-// agents/opencode_v2.ts
+// agents/opencode.ts
 var installCli = () => installOpencodeCli({ binPath: "bin/opencode.exe" });
 function buildSecurityConfig(ctx, model) {
   const config3 = {
@@ -110961,17 +111097,13 @@ function buildSecurityConfig(ctx, model) {
       log.info(`\xBB subagent models: reviewfrog=${reviewerModel}`);
       return cfg;
     })(),
-    // gemini-3 thinking pinned to high for review depth; deepseek (funded
-    // efficient tier) pinned to high reasoning effort, and kimi pinned away
-    // from Enforcer-less openrouter providers (siliconflow / together) that
-    // drop optional tool-call params — both per-model on the openrouter route,
-    // so other models are unaffected. gpt/anthropic effort set elsewhere (gpt:
-    // upstream default, anthropic: --effort flag in claude.ts). see opencodeShared.ts.
+    // kimi pinned away from Enforcer-less openrouter providers (siliconflow /
+    // together) that drop optional tool-call params — per-model on the
+    // openrouter route, so other models are unaffected. this is routing, not
+    // reasoning: every model's effort now rides the per-prompt `variant`.
+    // see opencodeShared.ts.
     provider: {
-      google: { models: geminiHighThinkingOverrides() },
-      openrouter: {
-        models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
-      },
+      openrouter: { models: kimiOpenRouterProviderOverrides() },
       ...openAICompatibleProvider(model)
     }
   };
@@ -111282,6 +111414,7 @@ async function runPromptTurn(ctx, params) {
       {
         sessionID: ctx.sessionID,
         parts: [part],
+        ...ctx.variant ? { variant: ctx.variant } : {},
         ...params.model ? { model: params.model } : {}
       },
       // wire the inner activity watchdog's abort signal into the SDK request
@@ -111471,6 +111604,10 @@ var opencode = agent({
     const cliPath = await installCli();
     const rawModel = ctx.payload.proxyModel ?? ctx.resolvedModel ?? autoSelectModel();
     if (rawModel) ctx.toolState.model = rawModel;
+    const effort = resolveRunEffort({ ...ctx, resolvedModel: rawModel });
+    if (!ctx.resolvedModel && !ctx.payload.proxyModel) {
+      log.info(`\xBB effort: ${effort.rung ?? "n/a (model has no effort control)"}`);
+    }
     const bedrockModelId = process.env[BEDROCK_MODEL_ID_ENV]?.trim();
     const isBedrockRoute = rawModel !== void 0 && bedrockModelId !== void 0 && bedrockModelId === rawModel;
     const vertexModel = resolveVertexOpenCodeModel(rawModel);
@@ -111563,6 +111700,8 @@ var opencode = agent({
         orchestratorSessionID: sessionID,
         labeler,
         toolState: ctx.toolState,
+        // `rawModel` folds in the auto-select pick — see the opencode.ts twin.
+        variant: effort.rung,
         todoTracker: ctx.todoTracker,
         onActivityTimeout: ctx.onActivityTimeout,
         onToolUse: ctx.onToolUse,
@@ -159948,6 +160087,7 @@ var JsonPayload = type({
   version: "string",
   "model?": "string | undefined",
   "modelExplicit?": "boolean | undefined",
+  "effort?": "number | string | undefined",
   prompt: "string",
   "triggerer?": "string | undefined",
   "baseInstructions?": "string | undefined",
@@ -159967,6 +160107,9 @@ var JsonPayload = type({
     id: "string",
     type: "'issue' | 'review'"
   }).or("undefined"),
+  // optional so a payload from an older server build (pre-`checkRun`) still parses
+  // against a newer action across a rolling deploy.
+  "checkRun?": type({ id: "string" }).or("undefined"),
   "generateSummary?": "boolean | undefined"
 });
 var COLLABORATOR_PERMISSIONS = ["admin", "maintain", "write"];
@@ -159978,6 +160121,7 @@ var Inputs = type({
   "prompt?": type.string.or("undefined"),
   "prompt_file?": type.string.or("undefined"),
   "model?": type.string.or("undefined"),
+  "effort?": type.string.or("undefined"),
   "timeout?": type.string.or("undefined"),
   "push?": PushPermissionInput.or("undefined"),
   "shell?": ShellPermissionInput.or("undefined"),
@@ -160032,6 +160176,7 @@ function resolvePromptFile(input) {
 function resolveNonPromptInputs() {
   return Inputs.omit("prompt", "prompt_file").assert({
     model: core4.getInput("model") || void 0,
+    effort: core4.getInput("effort") || void 0,
     timeout: core4.getInput("timeout") || void 0,
     cwd: core4.getInput("cwd") || void 0,
     push: core4.getInput("push") || void 0,
@@ -160050,6 +160195,8 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
   const rawEvent = jsonPayload?.event;
   const event = isPayloadEvent(rawEvent) ? rawEvent : { trigger: "unknown" };
   const model = jsonPayload?.model ?? inputs.model ?? repoSettings.model ?? void 0;
+  const rawEffort = jsonPayload?.effort ?? inputs.effort ?? repoSettings.effort ?? void 0;
+  const effort = rawEffort === void 0 ? void 0 : parseEffortPosition(String(rawEffort));
   const isNonCollaborator = !isCollaborator(event);
   const repoShell = repoSettings.shell ?? "restricted";
   const inputShell = inputs.shell;
@@ -160069,6 +160216,7 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     // explicit only when the model came from a per-run override flag (carried on
     // the JSON payload). a GHA `model` input or the repo default is not explicit.
     modelExplicit: jsonPayload?.modelExplicit ?? false,
+    effort,
     prompt,
     triggerer: jsonPayload?.triggerer ?? // it's not a common use case but GITHUB_ACTOR can be a user when the workflow is manually triggered by a user through GitHub Actions UI
     (!isPullfrog(process.env.GITHUB_ACTOR) ? process.env.GITHUB_ACTOR : void 0),
@@ -160080,13 +160228,19 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     timeout: inputs.timeout ?? jsonPayload?.timeout,
     cwd: resolveCwd(inputs.cwd),
     progressComment: jsonPayload?.progressComment,
+    checkRun: jsonPayload?.checkRun,
     generateSummary: jsonPayload?.generateSummary,
     // permissions: inputs > repoSettings > fallbacks
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
-    // opt-in commit-status check-runs (branch protection). workflow-level
-    // static input, off unless the repo's pullfrog.yml sets status_checks: enabled.
-    statusChecks: inputs.status_checks === "enabled",
+    // the `pullfrog` run-lifecycle check. ON by default — the whole point is that a PR
+    // shows whether Pullfrog is running without anyone having to opt in. the workflow
+    // input is the source of truth when set (mirrors `push`); otherwise the repo
+    // setting decides.
+    runStatusCheck: inputs.status_checks === void 0 ? repoSettings.statusChecks : inputs.status_checks === "enabled",
+    // the `pullfrog-approval` verdict check stays opt-in and workflow-only. it exists to
+    // be *required* by branch protection, so it must never turn itself on.
+    approvalCheck: inputs.status_checks === "enabled",
     // temporary progress chrome. the workflow input is the source of truth when
     // set (mirrors `push`); otherwise the repo setting decides. defaults to true.
     progressComments: inputs.progress_comments === void 0 ? repoSettings.progressComments : inputs.progress_comments === "enabled",
@@ -160614,7 +160768,11 @@ async function approveAfterFix(ctx) {
     approved: true,
     hasComments: false
   });
-  ctx.toolState.approval = { wouldApprove: true, sha: headSha };
+  ctx.toolState.approval = {
+    wouldApprove: true,
+    sha: headSha,
+    url: result.data.html_url
+  };
   log.info(`\xBB auto-approved #${pullNumber} after fix run (review ${result.data.id})`);
   await deleteProgressComment(ctx).catch((err) => {
     log.debug(`progress comment cleanup after fix auto-approval failed: ${err}`);
@@ -160947,6 +161105,7 @@ function CreatePullRequestReviewTool(ctx) {
         }
         const reviewId = result.data.id;
         const reviewNodeId = result.data.node_id;
+        if (ctx.toolState.approval) ctx.toolState.approval.url = result.data.html_url;
         log.info(`\xBB created review ${reviewId} on pull request #${pull_number}`);
         const actuallyReviewedSha = primary.checkoutSha ?? params.commit_id;
         ctx.toolState.review = {
@@ -165523,6 +165682,140 @@ function formatApiKeyErrorSummary(params) {
   ].join("\n");
 }
 
+// utils/billingErrors.ts
+var BillingError = class extends Error {
+  code;
+  declineCode;
+  needsReauthentication;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "BillingError";
+    this.code = opts.code ?? null;
+    this.declineCode = opts.declineCode ?? null;
+    this.needsReauthentication = opts.needsReauthentication ?? false;
+  }
+};
+var TransientError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransientError";
+  }
+};
+function billingConsoleUrl(owner) {
+  return `https://pullfrog.com/console/${encodeURIComponent(owner)}#billing`;
+}
+function commercialPaywallBody(params) {
+  if (params.reason === "commercial") {
+    return [
+      `**Pullfrog needs a confirmed Pro plan for ${params.ownerLogin}, so this run paused.**`,
+      "",
+      "Open Plan and payment to confirm Pro or review the organization's billing status.",
+      "",
+      `[Review plan and payment \u2192](${params.url})`
+    ].join("\n");
+  }
+  params.reason;
+  return [
+    `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
+    "",
+    "Update the card on file to resume runs.",
+    "",
+    `[Update billing \u2192](${params.url})`
+  ].join("\n");
+}
+function formatCommercialGateSummary(params) {
+  return commercialPaywallBody({
+    reason: params.reason,
+    ownerLogin: params.ownerLogin,
+    url: billingConsoleUrl(params.ownerLogin)
+  });
+}
+function formatBillingErrorSummary(error49, owner) {
+  if (error49.code === "router_requires_card") {
+    return [
+      "**Your Pullfrog Router balance is empty.**",
+      "",
+      "Add a card to top up your Router balance, or bring your own key. Router usage is billed at provider cost with no platform markup.",
+      "",
+      `[Add a card to top up \u2192](${billingConsoleUrl(owner)}) \xB7 [Bring your own key \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  if (error49.code === "router_balance_exhausted") {
+    return [
+      "**Your Pullfrog Router balance is exhausted.**",
+      "",
+      "You have a payment method on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.",
+      "",
+      `[Top up balance \u2192](${billingConsoleUrl(owner)}) \xB7 [Enable auto-reload \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  if (error49.code === "router_keylimit_exhausted") {
+    return [
+      "**This run was cut short: your Pullfrog Router balance ran out mid-run.**",
+      "",
+      "OpenRouter stopped the agent because the per-run budget was exhausted. Your wallet is now negative; top up or enable auto-reload to keep runs flowing.",
+      "",
+      `[Top up balance \u2192](${billingConsoleUrl(owner)}) \xB7 [Enable auto-reload \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  if (error49.code === "router_monthly_limit") {
+    return [
+      "**Pullfrog Router hit its monthly spend limit.**",
+      "",
+      "Auto-reloads are paused for the rest of this UTC month. Ask your admin to raise the cap, or wait for it to reset at 00:00 UTC on the 1st.",
+      "",
+      `[Adjust limit \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  if (error49.code === "commercial_plan_required") {
+    return formatCommercialGateSummary({
+      reason: "commercial",
+      ownerLogin: owner
+    });
+  }
+  if (error49.code === "subscription_unpaid") {
+    return formatCommercialGateSummary({
+      reason: "subscription_unpaid",
+      ownerLogin: owner
+    });
+  }
+  if (error49.needsReauthentication) {
+    const code = error49.declineCode ?? "authentication_required";
+    return [
+      `**Your card issuer requires 3D Secure on every charge** (\`${code}\`).`,
+      "",
+      "Pullfrog can't complete a 3DS challenge from inside a workflow. Top up your Router balance once in Stripe Checkout, subsequent runs draw from the prepaid balance without re-triggering 3DS.",
+      "",
+      `[Top up balance \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  if (error49.declineCode) {
+    return [
+      `**Your card was declined** (\`${error49.declineCode}\`).`,
+      "",
+      "Update your payment method and Pullfrog will retry on the next run.",
+      "",
+      `[Update payment method \u2192](${billingConsoleUrl(owner)})`
+    ].join("\n");
+  }
+  return [
+    "**Your Pullfrog balance is empty.**",
+    "",
+    "Top up your balance or enable auto-reload to keep runs flowing.",
+    "",
+    `[Manage billing \u2192](${billingConsoleUrl(owner)})`
+  ].join("\n");
+}
+function formatTransientErrorSummary(error49, owner) {
+  return [
+    "**Pullfrog billing is temporarily unavailable.**",
+    "",
+    error49.message,
+    "",
+    `Usually transient; the next dispatch should succeed. If it persists, check [status.pullfrog.com](https://status.pullfrog.com) or [your console](${billingConsoleUrl(owner)}).`
+  ].join("\n");
+}
+
 // utils/gitAuthServer.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync14 } from "node:fs";
@@ -166323,102 +166616,6 @@ function applyOverrides(params) {
 // utils/proxy.ts
 var core8 = __toESM(require_core(), 1);
 
-// utils/billingErrors.ts
-var BillingError = class extends Error {
-  code;
-  declineCode;
-  needsReauthentication;
-  constructor(message, opts = {}) {
-    super(message);
-    this.name = "BillingError";
-    this.code = opts.code ?? null;
-    this.declineCode = opts.declineCode ?? null;
-    this.needsReauthentication = opts.needsReauthentication ?? false;
-  }
-};
-var TransientError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TransientError";
-  }
-};
-function billingConsoleUrl(owner, anchor) {
-  return `https://pullfrog.com/console/${encodeURIComponent(owner)}#${anchor}`;
-}
-function formatBillingErrorSummary(error49, owner) {
-  if (error49.code === "router_requires_card") {
-    return [
-      "**Add a card to start using Pullfrog Router.**",
-      "",
-      "Router proxies OpenRouter at raw cost \u2014 no platform markup. Add a card and we'll auto-reload your wallet so runs keep flowing.",
-      "",
-      `[Add a card \u2192](${billingConsoleUrl(owner, "model-access")})`
-    ].join("\n");
-  }
-  if (error49.code === "router_balance_exhausted") {
-    return [
-      "**Your Pullfrog Router balance is exhausted.**",
-      "",
-      "You have a payment method on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.",
-      "",
-      `[Top up balance \u2192](${billingConsoleUrl(owner, "billing")}) \xB7 [Enable auto-reload \u2192](${billingConsoleUrl(owner, "model-access")})`
-    ].join("\n");
-  }
-  if (error49.code === "router_keylimit_exhausted") {
-    return [
-      "**This run was cut short \u2014 your Pullfrog Router balance ran out mid-run.**",
-      "",
-      "OpenRouter stopped the agent because the per-run budget was exhausted. Your wallet is now negative; top up or enable auto-reload to keep runs flowing.",
-      "",
-      `[Top up balance \u2192](${billingConsoleUrl(owner, "billing")}) \xB7 [Enable auto-reload \u2192](${billingConsoleUrl(owner, "model-access")})`
-    ].join("\n");
-  }
-  if (error49.code === "router_monthly_limit") {
-    return [
-      "**Pullfrog Router hit its monthly spend limit.**",
-      "",
-      "Auto-reloads are paused for the rest of this UTC month. Ask your admin to raise the cap, or wait for it to reset at 00:00 UTC on the 1st.",
-      "",
-      `[Adjust limit \u2192](${billingConsoleUrl(owner, "model-access")})`
-    ].join("\n");
-  }
-  if (error49.needsReauthentication) {
-    const code = error49.declineCode ?? "authentication_required";
-    return [
-      `**Your card issuer requires 3D Secure on every charge** (\`${code}\`).`,
-      "",
-      "Pullfrog can't complete a 3DS challenge from inside a workflow. Top up your Router balance once in Stripe Checkout \u2014 subsequent runs draw from the prepaid balance without re-triggering 3DS.",
-      "",
-      `[Top up balance \u2192](${billingConsoleUrl(owner, "billing")})`
-    ].join("\n");
-  }
-  if (error49.declineCode) {
-    return [
-      `**Your card was declined** (\`${error49.declineCode}\`).`,
-      "",
-      "Update your payment method and Pullfrog will retry on the next run.",
-      "",
-      `[Update payment method \u2192](${billingConsoleUrl(owner, "billing")})`
-    ].join("\n");
-  }
-  return [
-    "**Your Pullfrog balance is empty.**",
-    "",
-    "Top up your balance or enable auto-reload to keep runs flowing.",
-    "",
-    `[Manage billing \u2192](${billingConsoleUrl(owner, "billing")})`
-  ].join("\n");
-}
-function formatTransientErrorSummary(error49, owner) {
-  return [
-    "**Pullfrog billing is temporarily unavailable.**",
-    "",
-    error49.message,
-    "",
-    `Usually transient \u2014 the next dispatch should succeed. If it persists, check [status.pullfrog.com](https://status.pullfrog.com) or [your console](${billingConsoleUrl(owner, "billing")}).`
-  ].join("\n");
-}
-
 // utils/token.ts
 var core7 = __toESM(require_core(), 1);
 import assert2 from "node:assert/strict";
@@ -166952,6 +167149,7 @@ var core9 = __toESM(require_core(), 1);
 // utils/runContext.ts
 var defaultSettings = {
   model: null,
+  effort: null,
   modes: [],
   setupScript: null,
   postCheckoutScript: null,
@@ -166963,6 +167161,7 @@ var defaultSettings = {
   autoMergeEnabled: false,
   signedCommits: false,
   progressComments: true,
+  statusChecks: true,
   modeInstructions: {},
   learnings: null,
   learningsHeadings: [],
@@ -166998,6 +167197,11 @@ async function fetchRunContext(params) {
       signal: controller.signal
     });
     clearTimeout(timeoutId);
+    if (response.status === 402) {
+      const body = await response.json().catch(() => null);
+      const reason = typeof body === "object" && body !== null && "reason" in body && body.reason === "subscription_unpaid" ? "subscription_unpaid" : "commercial";
+      return { ...defaultRunContext, commercialRefused: reason };
+    }
     if (!response.ok) {
       return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
     }
@@ -167076,6 +167280,7 @@ async function resolveRunContextData(params) {
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
     dbSecrets: runContext.dbSecrets,
+    commercialRefused: runContext.commercialRefused,
     // a failed mint on a runner that should have been able to mint is the same
     // outcome as the server-side failure: the run never sees stored secrets.
     secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0
@@ -167459,6 +167664,7 @@ async function dispatchFollowUpReReview(ctx, reviewedSha) {
     "~pullfrog": true,
     version: ctx.payload.version,
     model: ctx.payload.model,
+    effort: ctx.payload.effort,
     prompt: "",
     eventInstructions: RE_REVIEW_PREAMBLE,
     event
@@ -167484,30 +167690,123 @@ function getCurrentWorkflowFilename() {
   return match3?.[1] ?? "pullfrog.yml";
 }
 
-// utils/statusChecks.ts
-var COMPLETION_CHECK = "pullfrog";
-var APPROVAL_CHECK = "pullfrog-approval";
-async function createCheckRun(ctx, params) {
+// utils/runStatusCheck.ts
+var RUN_STATUS_CHECK_NAME = "Pullfrog";
+var APPROVAL_CHECK_NAME = "Pullfrog approval";
+function parseCheckRunId(raw2) {
+  if (!raw2?.id) return void 0;
+  const id = parseInt(raw2.id, 10);
+  if (Number.isNaN(id) || id <= 0) return void 0;
+  return id;
+}
+function disableCheckLine(owner, repo) {
+  const url4 = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
+  return `
+
+[Turn off this check \u2192](${url4}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+}
+var TERMINAL_OUTPUT = {
+  success: {
+    title: "Pullfrog run completed",
+    summary: "The Pullfrog run finished successfully."
+  },
+  failure: {
+    title: "Pullfrog run failed",
+    summary: "The Pullfrog run failed. See the run logs for details."
+  },
+  cancelled: {
+    title: "Pullfrog run cancelled",
+    summary: "The Pullfrog run was cancelled before it finished."
+  },
+  timed_out: {
+    title: "Pullfrog run timed out",
+    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+  },
+  action_required: {
+    title: "Pullfrog run needs attention",
+    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+  },
+  neutral: {
+    title: "Pullfrog run finished",
+    summary: "The Pullfrog run finished without a pass or fail outcome."
+  },
+  skipped: {
+    title: "Pullfrog run skipped",
+    summary: "This run was superseded by another Pullfrog run."
+  },
+  stale: {
+    title: "Pullfrog run didn't finish",
+    summary: "Pullfrog never received a completion signal for this run. See the run logs for details."
+  }
+};
+function terminalOutput(params) {
+  const base = TERMINAL_OUTPUT[params.conclusion];
+  const review = params.reviewUrl ? `
+
+[View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
+  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
+  return { title: base.title, summary: base.summary + review + disable };
+}
+async function finalizeRunStatusCheck(params) {
+  const updateParams = {
+    owner: params.owner,
+    repo: params.repo,
+    check_run_id: params.checkRunId,
+    status: "completed",
+    conclusion: params.conclusion,
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
+  };
+  if (params.detailsUrl) updateParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.update(updateParams);
+}
+async function createTerminalRunStatusCheck(params) {
   const createParams = {
-    owner: ctx.repo.owner,
-    repo: ctx.repo.name,
-    name: params.name,
+    owner: params.owner,
+    repo: params.repo,
+    name: RUN_STATUS_CHECK_NAME,
     head_sha: params.headSha,
     status: "completed",
     conclusion: params.conclusion,
-    output: { title: params.title, summary: params.summary }
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
   };
-  if (ctx.runId) {
-    createParams.details_url = `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}`;
-  }
-  await ctx.octokit.rest.checks.create(createParams);
-  log.info(`\xBB posted ${params.name} check (${params.conclusion}) on ${params.headSha.slice(0, 7)}`);
+  if (params.detailsUrl) createParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.create(createParams);
 }
+
+// utils/statusChecks.ts
 async function reportStatusChecks(ctx, params) {
-  if (!ctx.payload.statusChecks) return;
   const event = ctx.payload.event;
   const pullNumber = event.issue_number;
   if (event.is_pr !== true || typeof pullNumber !== "number") return;
+  const checkRunId = parseCheckRunId(ctx.payload.checkRun);
+  if (checkRunId === void 0 && !ctx.payload.runStatusCheck && !ctx.payload.approvalCheck) return;
+  const conclusion = params.runSucceeded ? "success" : "failure";
+  const detailsUrl = ctx.runId ? `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}` : void 0;
+  if (checkRunId !== void 0) {
+    await finalizeRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      checkRunId,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB finalized ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} finalize failed: ${err}`));
+  }
+  const approval = ctx.toolState.approval;
+  const needsApprovalCheck = ctx.payload.approvalCheck && params.runSucceeded && approval;
+  const needsFallbackRunCheck = ctx.payload.runStatusCheck && checkRunId === void 0;
+  if (!needsApprovalCheck && !needsFallbackRunCheck) return;
   let headSha;
   try {
     const pr = await ctx.octokit.rest.pulls.get({
@@ -167520,24 +167819,32 @@ async function reportStatusChecks(ctx, params) {
     log.debug(`status checks: failed to resolve PR #${pullNumber} head sha: ${err}`);
     return;
   }
-  const completionSha = primaryRepoState(ctx.toolState).checkoutSha ?? headSha;
-  await createCheckRun(ctx, {
-    name: COMPLETION_CHECK,
-    headSha: completionSha,
-    conclusion: params.runSucceeded ? "success" : "failure",
-    title: params.runSucceeded ? "Pullfrog run completed" : "Pullfrog run failed",
-    summary: params.runSucceeded ? "The Pullfrog run finished successfully." : "The Pullfrog run failed or timed out. See the run logs for details."
-  }).catch((err) => log.debug(`status checks: ${COMPLETION_CHECK} post failed: ${err}`));
-  const approval = ctx.toolState.approval;
-  if (params.runSucceeded && approval) {
-    await createCheckRun(ctx, {
-      name: APPROVAL_CHECK,
-      headSha: approval.sha ?? headSha,
-      conclusion: approval.wouldApprove ? "success" : "failure",
+  if (needsFallbackRunCheck) {
+    await createTerminalRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      headSha: primaryRepoState(ctx.toolState).checkoutSha ?? headSha,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB posted ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} post failed: ${err}`));
+  }
+  if (!needsApprovalCheck || !approval) return;
+  const createParams = {
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    name: APPROVAL_CHECK_NAME,
+    head_sha: approval.sha ?? headSha,
+    status: "completed",
+    conclusion: approval.wouldApprove ? "success" : "failure",
+    output: {
       title: approval.wouldApprove ? "Pullfrog would approve" : "Pullfrog would not approve",
       summary: approval.wouldApprove ? "Pullfrog has no outstanding review feedback on this PR." : "Pullfrog has outstanding review feedback or requested changes on this PR."
-    }).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK} post failed: ${err}`));
-  }
+    }
+  };
+  if (detailsUrl) createParams.details_url = detailsUrl;
+  await ctx.octokit.rest.checks.create(createParams).then(() => log.info(`\xBB posted ${APPROVAL_CHECK_NAME} check`)).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK_NAME} post failed: ${err}`));
 }
 
 // utils/runLifecycle.ts
@@ -167610,7 +167917,8 @@ async function writeRunErrorOutputs(input) {
       error: input.rendered.comment,
       createIfMissing: true
     });
-  } catch {
+  } catch (error49) {
+    log.warning(`error comment failed: ${error49 instanceof Error ? error49.message : String(error49)}`);
   }
 }
 
@@ -167650,6 +167958,13 @@ function resolveModelForLog(ctx) {
   if (ctx.payload.model) return `${ctx.payload.model} (unresolved)`;
   return "auto";
 }
+function resolveEffortForLog(ctx) {
+  const effort = resolveRunEffort(ctx);
+  if (!ctx.resolvedModel && !ctx.payload.proxyModel) return "pending \u2014 model not chosen yet";
+  if (!effort.alias) return "not applied \u2014 model not recognized";
+  if (!effort.rung) return "n/a (model has no effort control)";
+  return effort.configured ? effort.rung : `${effort.rung} (default)`;
+}
 function resolveAgentForLog(ctx) {
   const envAgent = process.env.PULLFROG_AGENT?.trim();
   if (envAgent && envAgent === ctx.agentName) {
@@ -167664,6 +167979,9 @@ function logRunStartup(ctx) {
   log.info(
     `\xBB model:   ${resolveModelForLog({ payload: ctx.payload, resolvedModel: ctx.resolvedModel })}`
   );
+  log.info(
+    `\xBB effort:  ${resolveEffortForLog({ payload: ctx.payload, resolvedModel: ctx.resolvedModel })}`
+  );
   log.info(
     `\xBB agent:   ${resolveAgentForLog({ agentName: ctx.agentName, resolvedModel: ctx.resolvedModel })}`
   );
@@ -167829,7 +168147,7 @@ async function resolveRun(params) {
 
 // main.ts
 async function main() {
-  var _stack2 = [];
+  var _stack3 = [];
   try {
     normalizeEnv();
     const overridesRaw = process.env.UNSAFE_OVERRIDES ?? "";
@@ -167857,12 +168175,48 @@ async function main() {
     const initialOctokit = createOctokit(jobToken);
     const runContext = await resolveRunContextData({ octokit: initialOctokit, token: jobToken });
     timer.checkpoint("runContextData");
+    const payload = resolvePayload(resolvedPromptInput, runContext.repoSettings);
     const toolState = initToolState({
       progressComment: typeof resolvedPromptInput !== "string" ? resolvedPromptInput.progressComment : void 0,
       owner: runContext.repo.owner,
       name: runContext.repo.name,
       dir: process.cwd()
     });
+    toolState.model = payload.model;
+    toolState.oss = runContext.oss;
+    toolState.shaPinned = isActionPinnedToSha();
+    if (payload.event.issue_number !== void 0) {
+      primaryRepoState(toolState).issueNumber = payload.event.issue_number;
+    }
+    if (payload.event.trigger === "pull_request_synchronize") {
+      primaryRepoState(toolState).beforeSha = payload.event.before_sha;
+    }
+    const oidcCredentials = process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ? {
+      requestUrl: process.env.ACTIONS_ID_TOKEN_REQUEST_URL,
+      requestToken: process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
+    } : null;
+    if (runContext.commercialRefused) {
+      var _stack = [];
+      try {
+        const _commentTokenRef = __using(_stack, await resolveTokens({
+          push: "disabled",
+          oidc: oidcCredentials
+        }), true);
+        const errorMessage = runContext.commercialRefused === "subscription_unpaid" ? "Pro renewal failed for this organization" : "Pro plan required for this organization";
+        log.error(errorMessage);
+        const body = formatCommercialGateSummary({
+          reason: runContext.commercialRefused,
+          ownerLogin: runContext.repo.owner
+        });
+        await writeRunErrorOutputs({ rendered: { summary: body, comment: body }, toolState });
+        return { success: false, error: errorMessage };
+      } catch (_2) {
+        var _error = _2, _hasError = true;
+      } finally {
+        var _promise2 = __callDispose(_stack, _error, _hasError);
+        _promise2 && await _promise2;
+      }
+    }
     createTempDirectory();
     const opencodeCliPath = await agents.opencode.install();
     captureBaselineModels(opencodeCliPath);
@@ -167881,27 +168235,13 @@ async function main() {
     if (runContext.repoSettings.envAllowlist) {
       setEnvAllowlist(runContext.repoSettings.envAllowlist);
     }
-    const payload = resolvePayload(resolvedPromptInput, runContext.repoSettings);
-    toolState.model = payload.model;
-    toolState.oss = runContext.oss;
-    toolState.shaPinned = isActionPinnedToSha();
-    if (payload.event.issue_number !== void 0) {
-      primaryRepoState(toolState).issueNumber = payload.event.issue_number;
-    }
-    if (payload.event.trigger === "pull_request_synchronize") {
-      primaryRepoState(toolState).beforeSha = payload.event.before_sha;
-    }
-    const oidcCredentials = process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ? {
-      requestUrl: process.env.ACTIONS_ID_TOKEN_REQUEST_URL,
-      requestToken: process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
-    } : null;
     const xrepoUnavailable = payload.xrepo?.unavailable ?? [];
     if (xrepoUnavailable.length > 0) {
       log.warning(
         `\xBB --xrepo: requested but not granted: ${xrepoUnavailable.join(", ")} (unknown repo, different owner, or you lack access)`
       );
     }
-    const tokenRef = __using(_stack2, await resolveTokens({
+    const tokenRef = __using(_stack3, await resolveTokens({
       push: payload.push,
       xrepo: payload.xrepo,
       oidc: oidcCredentials
@@ -167926,7 +168266,7 @@ async function main() {
     let todoTracker;
     let vertexCredentials;
     try {
-      var _stack = [];
+      var _stack2 = [];
       try {
         if (payload.cwd && process.cwd() !== payload.cwd) {
           process.chdir(payload.cwd);
@@ -167946,7 +168286,7 @@ async function main() {
             payload.prompt = payload.prompt.replace(originalBody, resolvedBody ?? "");
           }
         }
-        const gitAuthServer = __using(_stack, await startGitAuthServer(tmpdir4), true);
+        const gitAuthServer = __using(_stack2, await startGitAuthServer(tmpdir4), true);
         setGitAuthServer(gitAuthServer);
         const access = decideModelAccess({
           modelExplicit: payload.modelExplicit ?? false,
@@ -167969,6 +168309,7 @@ async function main() {
         }
         if (access.kind === "proxy") payload.proxyModel = access.target;
         if (access.kind === "byok") payload.proxyModel = void 0;
+        if (runContext.oss && payload.proxyModel) payload.effort = 0;
         const resolvedModel = payload.proxyModel ? void 0 : resolveModel({ slug: payload.model });
         vertexCredentials = materializeVertexCredentials({ model: resolvedModel });
         const agent2 = resolveAgent({ model: resolvedModel });
@@ -168049,7 +168390,7 @@ async function main() {
           plan: runContext.plan,
           resolvedModel
         };
-        const mcpHttpServer = __using(_stack, await startMcpHttpServer(toolContext, { outputSchema }), true);
+        const mcpHttpServer = __using(_stack2, await startMcpHttpServer(toolContext, { outputSchema }), true);
         toolContext.mcpServerUrl = mcpHttpServer.url;
         log.info(`\xBB MCP server started at ${mcpHttpServer.url}`);
         timer.checkpoint("mcpServer");
@@ -168232,7 +168573,7 @@ ${instructions.user}` : null,
           const timeoutMs = usable ?? 36e5;
           const actualTimeout = usable !== null ? payload.timeout : "1h";
           let timeoutId;
-          const timeoutPromise = new Promise((_4, reject) => {
+          const timeoutPromise = new Promise((_5, reject) => {
             timeoutId = setTimeout(() => {
               reject(new Error(`agent run timed out after ${actualTimeout}`));
             }, timeoutMs);
@@ -168259,11 +168600,11 @@ ${instructions.user}` : null,
           toolContext,
           silent: payload.event.silent ?? false
         });
-      } catch (_2) {
-        var _error = _2, _hasError = true;
+      } catch (_3) {
+        var _error2 = _3, _hasError2 = true;
       } finally {
-        var _promise2 = __callDispose(_stack, _error, _hasError);
-        _promise2 && await _promise2;
+        var _promise3 = __callDispose(_stack2, _error2, _hasError2);
+        _promise3 && await _promise3;
       }
     } catch (error49) {
       const errorMessage = error49 instanceof Error ? error49.message : "unknown error occurred";
@@ -168307,11 +168648,11 @@ ${instructions.user}` : null,
       }
       cleanupVertexCredentials(vertexCredentials);
     }
-  } catch (_3) {
-    var _error2 = _3, _hasError2 = true;
+  } catch (_4) {
+    var _error3 = _4, _hasError3 = true;
   } finally {
-    var _promise3 = __callDispose(_stack2, _error2, _hasError2);
-    _promise3 && await _promise3;
+    var _promise4 = __callDispose(_stack3, _error3, _hasError3);
+    _promise4 && await _promise4;
   }
 }
 
@@ -168938,7 +169279,8 @@ async function handleSecret(ctx) {
   }
   if (method === "pullfrog") {
     const scope2 = ctx.secrets.isOrg ? await promptScope2(ctx) : "account";
-    activeSpin2.start(`saving ${envVar}`);
+    const target = describeSecretTarget({ owner: ctx.owner, repo: ctx.repo, scope: scope2 });
+    activeSpin2.start(`saving ${import_picocolors3.default.cyan(envVar)} to ${target}`);
     let saveResult;
     try {
       saveResult = await setPullfrogSecret2({
@@ -168958,7 +169300,7 @@ async function handleSecret(ctx) {
       return;
     }
     if (saveResult.saved) {
-      activeSpin2.stop(`saved ${import_picocolors3.default.cyan(envVar)} to Pullfrog`);
+      activeSpin2.stop(`saved ${import_picocolors3.default.cyan(envVar)} to ${target}`);
     } else {
       activeSpin2.stop(import_picocolors3.default.red("could not save secret"));
       O2.warn(
@@ -169308,7 +169650,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.46";
+var VERSION10 = "0.1.48";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);