pullfrog 0.1.50 → 0.1.52

package/dist/internal/index.d.ts

@@ -3,7 +3,7 @@
  * Re-exports shared types, values, and utilities needed by the Next.js app.
  */
 export type { AuthorPermission, AutoTier, EffortPosition, ModelAlias, ModelProvider, Payload, PayloadEvent, ProviderConfig, PushPermission, ShellPermission, ToolPermission, WriteablePayload, XrepoConfig, } from "../external.ts";
-export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, modelAliases, modelHasStoredAuth, offeredRungs, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
+export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export { commercialPaywallBody } from "../utils/billingErrors.ts";

package/dist/internal.js

@@ -100,7 +100,11 @@ var providers = {
     envVars: ["OPENAI_API_KEY"],
     managedCredentials: ["CODEX_AUTH_JSON"],
     models: {
-      gpt: {
+      // Sol/Terra/Luna are OpenAI's durable capability tiers, so they ARE the
+      // brand-tier names the slug convention asks for — the pre-5.6 `gpt` /
+      // `gpt-pro` / `gpt-mini` slugs are holdovers from the retired GPT / GPT Pro
+      // / GPT Mini tiering and are carried below as deprecated aliases.
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -111,24 +115,23 @@ var providers = {
       // Sol served at reasoning.mode=pro — same $/token as Sol, just more tokens
       // burned; not a pricier premium tier. models.dev has no -pro id, so direct-key
       // (BYOK) resolves to plain Sol; only the Router/OpenRouter path gets sol-pro.
-      "gpt-pro": {
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6's balanced mid-tier (Sol/Terra/Luna are durable capability tiers,
-      // not version bumps). selectable on its own and doubles as `gpt`'s cheaper
-      // lens-fanout subagent — replaces the old hidden gpt-5.4 subagent target.
+      // gpt-5.6's balanced mid-tier. selectable on its own and doubles as Sol's
+      // cheaper lens-fanout subagent — replaces the old hidden gpt-5.4 target.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openai/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "openai/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -143,20 +146,40 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "openai/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "openai/gpt"
+        fallback: "openai/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "openai/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "openai/gpt-mini"
+        fallback: "openai/gpt-luna"
+      },
+      // pre-5.6 tier slugs. the tiers themselves were renamed Sol/Sol Pro/Luna,
+      // so these fold forward rather than describing anything that still runs.
+      gpt: {
+        displayName: "GPT",
+        resolve: "openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "openai/gpt-sol"
+      },
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "openai/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "openai/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "openai/gpt-luna"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "openai/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "openai/gpt"
+        fallback: "openai/gpt-sol"
       },
       o3: {
         displayName: "O3",
@@ -232,12 +255,20 @@ var providers = {
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro",
         preferred: true
       },
+      // DeepSeek upgraded the `deepseek-v4-flash` API model in place to the
+      // 0731 release, but OpenRouter forked it into a separate `-0731` id and
+      // left the April preview live at a HIGHER price — so the direct
+      // `resolve` needs no version and the OpenRouter route must be pinned.
+      // 0731 publishes a DIFFERENT OpenRouter ladder to both the April preview
+      // and Pro (`high, xhigh`) — it gained a `low` rung and renamed the top to
+      // `max`. that makes `low`, not `high`, position 0 on this route, which is
+      // why the OSS effort floor in `main.ts` pins the `high` rung by name.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-v4-flash",
         effort: ["high", "max"],
-        openRouterEffort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash-0731"
       },
       // legacy aliases — deepseek retires these on 2026-07-24; transparently
       // upgrade existing users to the v4 family via the fallback chain.
@@ -306,30 +337,30 @@ var providers = {
         resolve: "opencode/claude-haiku-4-5",
         openRouterResolve: "openrouter/anthropic/claude-haiku-4.5"
       },
-      gpt: {
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "opencode/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
-      // see openai/gpt-pro — Zen has no -pro id, so direct resolves to plain Sol.
-      "gpt-pro": {
+      // see openai/gpt-sol-pro — Zen has no -pro id, so direct resolves to plain Sol.
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "opencode/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6 balanced mid-tier — selectable + `gpt`'s subagent. see openai above.
+      // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "opencode/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "opencode/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -340,20 +371,39 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "opencode/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "opencode/gpt"
+        fallback: "opencode/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "opencode/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "opencode/gpt-mini"
+        fallback: "opencode/gpt-luna"
+      },
+      // pre-5.6 tier slugs — see openai provider above.
+      gpt: {
+        displayName: "GPT",
+        resolve: "opencode/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "opencode/gpt-sol"
+      },
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "opencode/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "opencode/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "opencode/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "opencode/gpt-luna"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "opencode/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "opencode/gpt"
+        fallback: "opencode/gpt-sol"
       },
       "gemini-pro": {
         displayName: "Gemini Pro",
@@ -509,30 +559,30 @@ var providers = {
       // alias): after the Sol/Terra/Luna rename, ~gpt-mini-latest no longer maps
       // to Luna, so rolling aliases would silently diverge `gpt`/`gpt-mini` from
       // the chosen tiers across funding paths.
-      gpt: {
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "openrouter/openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
-      // see openai/gpt-pro. openrouter serves sol-pro directly on both routes.
-      "gpt-pro": {
+      // see openai/gpt-sol-pro. openrouter serves sol-pro directly on both routes.
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openrouter/openai/gpt-5.6-sol-pro",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6 balanced mid-tier — selectable + `gpt`'s subagent. see openai above.
+      // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openrouter/openai/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "openrouter/openai/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -543,20 +593,39 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "openrouter/openai/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "openrouter/gpt"
+        fallback: "openrouter/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "openrouter/openai/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "openrouter/gpt-mini"
+        fallback: "openrouter/gpt-luna"
+      },
+      // pre-5.6 tier slugs — see openai provider above.
+      gpt: {
+        displayName: "GPT",
+        resolve: "openrouter/openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "openrouter/gpt-sol"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "openrouter/openai/gpt-5.6-sol-pro",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "openrouter/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "openrouter/openai/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "openrouter/gpt-luna"
+      },
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "openrouter/openai/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "openrouter/gpt"
+        fallback: "openrouter/gpt-sol"
       },
       "o4-mini": {
         displayName: "O4 Mini",
@@ -591,9 +660,9 @@ var providers = {
       },
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
-        resolve: "openrouter/deepseek/deepseek-v4-flash",
-        effort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
+        resolve: "openrouter/deepseek/deepseek-v4-flash-0731",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash-0731"
       },
       // legacy alias — deepseek retires this on 2026-07-24; transparently
       // upgrade existing users to the v4 family via the fallback chain.
@@ -688,7 +757,7 @@ var modelAliases = Object.entries(providers).flatMap(
 var AUTO_EFFICIENT = "auto/efficient";
 var AUTO_INTELLIGENT = "auto/intelligent";
 var AUTO_TIER_TARGET = {
-  [AUTO_EFFICIENT]: "deepseek/deepseek-pro",
+  [AUTO_EFFICIENT]: "deepseek/deepseek-flash",
   [AUTO_INTELLIGENT]: "anthropic/claude-opus"
 };
 function isAutoTier(slug) {
@@ -744,6 +813,26 @@ if (!defaultProxyAlias?.openRouterResolve) {
 }
 var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
+var OSS_MODEL_ALLOWLIST = [
+  "deepseek/deepseek-flash",
+  "deepseek/deepseek-pro",
+  "openai/gpt-luna",
+  "openrouter/minimax-m2.5",
+  "moonshotai/kimi-k2"
+];
+var OSS_RECOMMENDED_MODEL = AUTO_TIER_TARGET[AUTO_EFFICIENT];
+var ossAllowedTargets = new Set(
+  OSS_MODEL_ALLOWLIST.map((slug) => {
+    const target = resolveOpenRouterModel(slug);
+    if (!target) throw new Error(`OSS_MODEL_ALLOWLIST: ${slug} has no openRouterResolve`);
+    return target;
+  })
+);
+function isOssAllowedModel(slug) {
+  if (!slug) return false;
+  const target = resolveOpenRouterModel(slug);
+  return target !== void 0 && ossAllowedTargets.has(target);
+}
 function getAutoSelectHintModel() {
   return defaultProxyDisplayName;
 }
@@ -1197,7 +1286,7 @@ function formatModelLabel(params) {
     const ossBase = `\`${displayName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
     if (params.clamped?.reason !== "oss") return ossBase;
     const configured = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
-    return `${ossBase} (${configured} not used \u2014 the program covers this model; add its [provider key](https://docs.pullfrog.com/models) to run your pick)`;
+    return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
   const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
   if (params.fallbackFrom) {
@@ -1597,6 +1686,8 @@ export {
   LEAPING_INTO_ACTION_PREFIX,
   MAX_LEARNINGS_LENGTH,
   OAuthInvalidGrantError,
+  OSS_MODEL_ALLOWLIST,
+  OSS_RECOMMENDED_MODEL,
   PULLFROG_DIVIDER,
   RUN_STATUS_CHECK_NAME,
   TIMEOUT_DISABLED,
@@ -1619,6 +1710,7 @@ export {
   isCardGatedModel,
   isEffortPosition,
   isLeapingIntoActionCommentBody,
+  isOssAllowedModel,
   isPullfrog,
   isValidTimeString,
   modelAliases,

package/dist/mcp/shell.d.ts

@@ -1,7 +1,7 @@
 import type { ToolContext } from "./server.ts";
 export declare const ShellParams: import("arktype/internal/variants/object.ts").ObjectType<{
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;
@@ -16,13 +16,13 @@ export declare function getSandboxMethod(): SandboxMethod;
 export declare const MAX_OUTPUT_CHARS = 5000;
 export declare function ShellTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;
 }, {
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;

package/dist/models.d.ts

@@ -145,11 +145,11 @@ export declare const modelAliases: ModelAlias[];
  * concrete alias by `resolveDisplayAlias` below, so every downstream consumer
  * (CLI resolve, OpenRouter resolve, footer label) handles them transparently.
  *
- * `efficient` mirrors the OSS/default subsidy model (DeepSeek V4 Pro — beats
- * Kimi K2.7 on agentic-review quality at ~4-5x lower cost, run at whatever
- * effort the repo asks for, clamped to its published ladder); `intelligent` is the
- * frontier pick (Claude Opus). a `null` model means the tier hasn't been
- * pinned: callers default by card status via `defaultAutoTier`.
+ * `efficient` mirrors the OSS/default subsidy model (DeepSeek Flash — the 0731
+ * release is DeepSeek's first officially-shipped V4, where Pro is still the
+ * April preview, and it costs ~0.45x Pro on our cache-heavy review workload);
+ * `intelligent` is the frontier pick (Claude Opus). a `null` model means the
+ * tier hasn't been pinned: callers default by card status via `defaultAutoTier`.
  */
 export declare const AUTO_EFFICIENT = "auto/efficient";
 export declare const AUTO_INTELLIGENT = "auto/intelligent";
@@ -235,6 +235,30 @@ export declare function resolveModelRung(params: {
     useOpenRouter: boolean;
 }): string | undefined;
 export declare const DEFAULT_PROXY_MODEL: string;
+/**
+ * the models Pullfrog is willing to fund on the OSS program. an accepted OSS
+ * repo may pick any of these and run-context honors the pick; anything else
+ * falls back to `DEFAULT_PROXY_MODEL`, so a subsidized run can never land on a
+ * frontier model.
+ *
+ * membership is a spend decision, so it lives here as a literal rather than a
+ * DB toggle — changing it is a deploy, which is the right friction. costs below
+ * are modelled on the measured OSS token mix, where cache reads are ~87.5% of
+ * input and list price therefore ranks models WRONG: Luna 0.39x, Flash 0.45x,
+ * Pro 1.00x, MiniMax M2 1.30x, Kimi 3.88x modelled — but 7.25x as actually
+ * measured over the pre-#1063 Kimi era, which is the number to trust.
+ */
+export declare const OSS_MODEL_ALLOWLIST: readonly string[];
+/** the pick the console badges. DERIVED from the efficient tier rather than
+ * restated, so the badge cannot drift from the model that actually runs — a
+ * second literal here would be an invariant nothing enforces. */
+export declare const OSS_RECOMMENDED_MODEL: string;
+/**
+ * whether an OSS repo's stored pick is one the program funds. resolves through
+ * the fallback chain first, so `auto/*` sentinels and deprecated slugs are
+ * judged by the model that actually runs.
+ */
+export declare function isOssAllowedModel(slug: string | null | undefined): slug is string;
 /** short label for the model auto-select picks today (console hint copy). */
 export declare function getAutoSelectHintModel(): string;
 /** env var that supplies the Bedrock model ID for the `bedrock/byok` slug. */

package/dist/utils/activity.d.ts

@@ -1,3 +1,11 @@
+/**
+ * whether the operator asked for debug output — GitHub's own "re-run with debug
+ * logging" (`RUNNER_DEBUG=1`), the `ACTIONS_STEP_DEBUG=true` repo secret, or a
+ * local `LOG_LEVEL=debug`. lives here rather than in `log.ts` because this
+ * module imports only `node:perf_hooks`, so every other util can depend on it
+ * without a cycle. one switch raises every diagnostic we own.
+ */
+export declare function isDebugEnabled(): boolean;
 /**
  * generic `spawn()` idle default for ordinary short-lived subprocesses (prep
  * probes, package-manager invocations, dependency installs). these should be

package/dist/utils/apiKeys.d.ts

@@ -53,15 +53,19 @@ export declare function validateAgentApiKey(params: {
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**
- * Expired OAuth-connection credential shapes (#931) — the fix is to
- * re-authenticate the provider connection (`pullfrog auth <provider>`), not
- * to rotate a repo-secret API key, so `formatApiKeyErrorSummary` renders
- * distinct copy for these. Patterns are deliberately narrow:
- * "authentication token has expired" (not bare "token has expired") so a
- * GitHub installation-token expiry can't be misread as an LLM key problem.
- * also covers server-side revocation ("authentication token has been
- * invalidated", OpenAI `token_invalidated`, #1041) and the Claude CLI's
- * "OAuth access token has expired" phrasing (#1072) — same remediation.
+ * Dead OAuth-connection credential — the provider is telling us the token
+ * itself is finished (expired, invalidated, revoked, or unrecognised), and the
+ * only fix is to re-authenticate the connection (`pullfrog auth <provider>`),
+ * never to rotate a repo-secret API key. `formatApiKeyErrorSummary` renders
+ * distinct copy for the whole class.
+ *
+ * Match the SHAPE, not the sentence. Four prior issues (#931, #1041, #1072,
+ * #1122) each landed one more literal and the next provider rewording walked
+ * straight through, so these patterns are parameterised over the two things
+ * that vary — which token noun the provider uses, and which terminal state it
+ * reports. Still deliberately narrow on the noun ("authentication token" /
+ * "OAuth access token", never bare "token") so a GitHub installation-token
+ * expiry can't be misread as an LLM credential problem.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
 /**
@@ -70,6 +74,7 @@ export declare function isOAuthCredentialExpiredError(text: string): boolean;
  * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
  */
 export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
+export declare function isClaudeSessionLimitError(text: string): boolean;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/gitAuth.d.ts

@@ -17,7 +17,20 @@ type SafeGitSubcommand = "fetch" | "push";
 type GitAuthOptions = {
     token: string;
     cwd?: string;
+    /**
+     * re-mint the git token when GitHub hands out one its git edge never accepts.
+     * when present, an auth-class failure is retried ONCE with a fresh token.
+     */
+    refreshGitToken?: ((stale: string) => Promise<string>) | undefined;
 };
+/**
+ * installation-token 401s on git. GitHub intermittently mints a token its git
+ * edge never accepts, so retrying the SAME token never recovers — only a
+ * re-mint does. lives here rather than next to `classifyPushError` in
+ * `mcp/git.ts` because the fetch path needs it too and `git.ts` imports this
+ * module, not the other way round. see #1115.
+ */
+export declare const TRANSIENT_AUTH_PATTERNS: RegExp[];
 type GitResult = {
     stdout: string;
     stderr: string;

package/dist/utils/modelAccess.d.ts

@@ -34,8 +34,10 @@ export type ModelAccessDecision = {
  * decide whether an (already-resolved) requested model can run, and how.
  *
  * - non-explicit / no model → `ok` (caller's missing-key validation applies).
- * - proxy active + OSS → only the funded subsidy target routes; a different
- *   model needs the repo's own key (`byok`) else `error("oss")`.
+ * - proxy active + OSS → the funded subsidy target and anything else on
+ *   `OSS_MODEL_ALLOWLIST` route; a model off the list needs the repo's own key
+ *   (`byok`) else `error("oss")`. the allowlist arm is what keeps
+ *   `--model=<allowlisted>` from hard-failing on a pick the console offers.
  * - proxy active + Router → honor any Router-servable model (`proxy`); fall to
  *   BYOK when locally authorized, else `error("router")`.
  * - no proxy → the resolved model must be locally authorized, else

package/dist/utils/packageManager.d.ts

@@ -47,3 +47,25 @@ export interface EnsurePackageManagerParams {
  * still works; we just don't get our version guarantee.
  */
 export declare function ensurePackageManager(params: EnsurePackageManagerParams): Promise<boolean>;
+/** `SupportedPackageManager` plus deno, which corepack never manages. */
+export type ProvisionablePackageManager = SupportedPackageManager | "deno";
+/**
+ * Put the project's package manager on PATH, by whichever route provisions it —
+ * corepack for pnpm/yarn, `npm i -g` for bun, the install script for deno.
+ * Returns an error string on failure, else null.
+ *
+ * Callers must gate this on shell being enabled; provisioning executes code.
+ *
+ * Idempotent by construction (`isCommandAvailable` short-circuits and
+ * `ensurePackageManager` caches on a `--version` match), which is what lets
+ * `main.ts` call it BEFORE the `setup` lifecycle hook and the prep phase call it
+ * again later for the cost of one `which`. That ordering is the point: a `setup`
+ * hook running `bun install` used to die with `bun: command not found` 0.8s
+ * before Pullfrog installed bun itself, because the pre-hook site only ever
+ * asked corepack — which ignores bun and deno entirely. See #1121.
+ */
+export declare function provisionPackageManager(params: {
+    name: ProvisionablePackageManager;
+    declared: PackageManagerSpec | null;
+    binDir: string;
+}): Promise<string | null>;

package/dist/utils/rangeDiff.d.ts

@@ -32,7 +32,26 @@ type ComputeIncrementalDiffParams = {
  * - patch-text diffing (interdiff / diff-of-diffs): fragile, hunk offset noise on rebase
  * - range-diff on raw commit ranges: confused by commit reorganization across force-pushes
  */
-export declare function computeIncrementalDiff(params: ComputeIncrementalDiffParams): string | null;
+export type IncrementalDiffResult = 
+/** range-diff ran and produced a delta */
+{
+    status: "ok";
+    diff: string;
+}
+/** range-diff ran and the two versions are identical */
+ | {
+    status: "empty";
+}
+/** range-diff could not run — most often `beforeSha` has no ancestry to
+ *  merge-base against on a shallow clone. distinct from "empty" on purpose:
+ *  they were the same `null` before, so `checkout_pr` could not tell the
+ *  agent whether there was nothing to see or whether we had simply failed.
+ *  see #1139. */
+ | {
+    status: "unavailable";
+    reason: string;
+};
+export declare function computeIncrementalDiff(params: ComputeIncrementalDiffParams): IncrementalDiffResult;
 /**
  * transforms git range-diff output into a clean incremental diff.
  *

package/dist/utils/runContext.d.ts

@@ -37,6 +37,7 @@ export interface RepoSettings {
     repoIntelligence: boolean;
     progressComments: boolean;
     statusChecks: boolean;
+    approvalCheck: boolean;
     modeInstructions: Record<string, string>;
     learnings: string | null;
     learningsHeadings: LearningsHeading[];

package/dist/utils/runEffort.d.ts

@@ -21,6 +21,21 @@ export interface RunEffort {
     /** the catalog alias the ladder came from, if we recognized one. */
     alias: ModelAlias | undefined;
 }
+/**
+ * the position a subsidised run is pinned to — the `high` rung on the ladder of
+ * the funded model. only reachable on the subsidy proxy, so the ladder is always
+ * the OpenRouter one.
+ *
+ * `high` by name, not position 0. position 0 was equivalent for as long as every
+ * subsidy candidate's ladder started at `high`, but DeepSeek V4 Flash 0731
+ * publishes `low, high, max` on the OpenRouter route, so the floor would have
+ * silently dropped a level the moment that became the funded default — undoing
+ * the `high`-effort result #1063 chose the tier on. a model publishing no `high`
+ * falls back to its own floor.
+ */
+export declare function ossEffortFloor(ctx: {
+    payload: ResolvedPayload;
+}): EffortPosition;
 export declare function resolveRunEffort(ctx: {
     payload: ResolvedPayload;
     resolvedModel?: string | undefined;

package/dist/utils/runErrorRenderer.d.ts

@@ -27,6 +27,14 @@
  *   4. ProviderModelNotFoundError — configured model id no longer in the
  *      OpenCode catalog; renders a nudge to pick a different model.
  *
+ *   4a. No-provider-available (#1077) — the model IS in the catalog but the
+ *      provider declines to route it on this account's plan (OpenCode Zen's
+ *      own refusal string). Same "pick another model" CTA, different reason.
+ *
+ *   4b. Context-window overflow (#1116) — terminal `Prompt is too long` /
+ *      `maximum context length is N tokens`. Actionable, so it renders on
+ *      both surfaces rather than collapsing to the one-line comment.
+ *
  *   5. Activity-timeout hang — `errorMessage` starts with
  *      `"activity timeout"` or `"agent still pending"` AND none of the
  *      above matched. The harness keeps structured diagnostic state on
@@ -43,8 +51,9 @@
  *      banner; the PR comment collapses to the same one-line logs link as
  *      the hang case, since the raw internal string helps nobody on the PR.
  *
- * Net: the actionable classifications (billing, API-key, model-not-found)
- * render identical bodies on both surfaces; the non-actionable ones (hang,
+ * Net: the actionable classifications (billing, API-key, model-not-found,
+ * no-provider-available, context-overflow) render identical bodies on both
+ * surfaces; the non-actionable ones (hang,
  * generic) keep the forensics in the Actions job summary and show a calm
  * one-liner in the PR comment, whose footer already carries Pullfrog
  * branding + rerun links.
@@ -61,4 +70,8 @@ export declare function renderRunError(input: {
         name: string;
     };
     agentDiagnostic: AgentDiagnostic | undefined;
+    /** the run is spending Pullfrog's Router wallet (a proxy key was minted), not
+     * the user's own provider credential. `payload.proxyModel` at both call
+     * sites. */
+    routerActive: boolean;
 }): RenderedRunError;