pullfrog 0.1.51 → 0.1.53

package/dist/internal/index.d.ts

@@ -3,7 +3,7 @@
  * Re-exports shared types, values, and utilities needed by the Next.js app.
  */
 export type { AuthorPermission, AutoTier, EffortPosition, ModelAlias, ModelProvider, Payload, PayloadEvent, ProviderConfig, PushPermission, ShellPermission, ToolPermission, WriteablePayload, XrepoConfig, } from "../external.ts";
-export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, modelAliases, modelHasStoredAuth, offeredRungs, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
+export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export { commercialPaywallBody } from "../utils/billingErrors.ts";

package/dist/internal.js

@@ -100,7 +100,11 @@ var providers = {
     envVars: ["OPENAI_API_KEY"],
     managedCredentials: ["CODEX_AUTH_JSON"],
     models: {
-      gpt: {
+      // Sol/Terra/Luna are OpenAI's durable capability tiers, so they ARE the
+      // brand-tier names the slug convention asks for — the pre-5.6 `gpt` /
+      // `gpt-pro` / `gpt-mini` slugs are holdovers from the retired GPT / GPT Pro
+      // / GPT Mini tiering and are carried below as deprecated aliases.
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -111,24 +115,23 @@ var providers = {
       // Sol served at reasoning.mode=pro — same $/token as Sol, just more tokens
       // burned; not a pricier premium tier. models.dev has no -pro id, so direct-key
       // (BYOK) resolves to plain Sol; only the Router/OpenRouter path gets sol-pro.
-      "gpt-pro": {
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6's balanced mid-tier (Sol/Terra/Luna are durable capability tiers,
-      // not version bumps). selectable on its own and doubles as `gpt`'s cheaper
-      // lens-fanout subagent — replaces the old hidden gpt-5.4 subagent target.
+      // gpt-5.6's balanced mid-tier. selectable on its own and doubles as Sol's
+      // cheaper lens-fanout subagent — replaces the old hidden gpt-5.4 target.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openai/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "openai/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -143,20 +146,40 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "openai/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "openai/gpt"
+        fallback: "openai/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "openai/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "openai/gpt-mini"
+        fallback: "openai/gpt-luna"
+      },
+      // pre-5.6 tier slugs. the tiers themselves were renamed Sol/Sol Pro/Luna,
+      // so these fold forward rather than describing anything that still runs.
+      gpt: {
+        displayName: "GPT",
+        resolve: "openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "openai/gpt-sol"
+      },
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "openai/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "openai/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "openai/gpt-luna"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "openai/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "openai/gpt"
+        fallback: "openai/gpt-sol"
       },
       o3: {
         displayName: "O3",
@@ -184,9 +207,9 @@ var providers = {
       },
       "gemini-flash": {
         displayName: "Gemini Flash",
-        resolve: "google/gemini-3.5-flash",
+        resolve: "google/gemini-3.6-flash",
         effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/google/gemini-3.5-flash"
+        openRouterResolve: "openrouter/google/gemini-3.6-flash"
       }
     }
   }),
@@ -196,26 +219,26 @@ var providers = {
     models: {
       grok: {
         displayName: "Grok",
-        resolve: "xai/grok-4.3",
-        effort: ["none", "low", "medium", "high"],
-        openRouterResolve: "openrouter/x-ai/grok-4.3",
+        resolve: "xai/grok-4.5",
+        effort: ["low", "medium", "high"],
+        openRouterResolve: "openrouter/x-ai/grok-4.5",
         preferred: true
       },
       // legacy aliases — xAI retired the entire fast/code-fast line on
       // 2026-05-15 (https://docs.x.ai/developers/migration/may-15-deprecation)
       // and now redirects every deprecated text-model slug to grok-4.3 at
       // standard pricing. fall back to the live `xai/grok` so the alias
-      // chain resolves to grok-4.3 for both direct-key and OpenRouter users.
+      // chain resolves to grok-4.5 for both direct-key and OpenRouter users.
       "grok-fast": {
         displayName: "Grok Fast",
         resolve: "xai/grok-4-1-fast",
-        openRouterResolve: "openrouter/x-ai/grok-4.3",
+        openRouterResolve: "openrouter/x-ai/grok-4.5",
         fallback: "xai/grok"
       },
       "grok-code-fast": {
         displayName: "Grok Code Fast",
         resolve: "xai/grok-code-fast-1",
-        openRouterResolve: "openrouter/x-ai/grok-4.3",
+        openRouterResolve: "openrouter/x-ai/grok-4.5",
         fallback: "xai/grok"
       }
     }
@@ -232,12 +255,25 @@ var providers = {
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro",
         preferred: true
       },
+      // DeepSeek upgrades the `deepseek-v4-flash` API model in place, so the
+      // direct `resolve` needs no version. OpenRouter instead forked the 0731
+      // release into its own id and left the April preview live under the
+      // unversioned one at a HIGHER price ($0.14/$0.28 vs $0.09/$0.18) — so the
+      // OpenRouter route can never use the bare id. it tracks the rolling
+      // `~deepseek/*-latest` pointer (rule 4), which resolves to 0731 at the
+      // same price today and follows the next in-place upgrade on its own,
+      // rather than pinning a dated snapshot that goes stale every release.
+      // 0731 gained a `low` rung and renamed the top to `max`, unlike Pro
+      // (`high, max` direct / `high, xhigh` via OpenRouter). that ladder now
+      // reads the same on BOTH routes — the in-place direct upgrade caught up
+      // to the fork — so `low`, not `high`, is position 0 either way, which is
+      // why the OSS effort floor in `main.ts` pins the `high` rung by name.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-v4-flash",
-        effort: ["high", "max"],
-        openRouterEffort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
+        effort: ["low", "high", "max"],
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/~deepseek/deepseek-v4-flash-latest"
       },
       // legacy aliases — deepseek retires these on 2026-07-24; transparently
       // upgrade existing users to the v4 family via the fallback chain.
@@ -306,30 +342,30 @@ var providers = {
         resolve: "opencode/claude-haiku-4-5",
         openRouterResolve: "openrouter/anthropic/claude-haiku-4.5"
       },
-      gpt: {
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "opencode/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
-      // see openai/gpt-pro — Zen has no -pro id, so direct resolves to plain Sol.
-      "gpt-pro": {
+      // see openai/gpt-sol-pro — Zen has no -pro id, so direct resolves to plain Sol.
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "opencode/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6 balanced mid-tier — selectable + `gpt`'s subagent. see openai above.
+      // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "opencode/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "opencode/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -340,20 +376,39 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "opencode/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "opencode/gpt"
+        fallback: "opencode/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "opencode/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "opencode/gpt-mini"
+        fallback: "opencode/gpt-luna"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      // pre-5.6 tier slugs — see openai provider above.
+      gpt: {
+        displayName: "GPT",
+        resolve: "opencode/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "opencode/gpt-sol"
+      },
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "opencode/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "opencode/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "opencode/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "opencode/gpt-luna"
+      },
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "opencode/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "opencode/gpt"
+        fallback: "opencode/gpt-sol"
       },
       "gemini-pro": {
         displayName: "Gemini Pro",
@@ -364,21 +419,19 @@ var providers = {
       },
       "gemini-flash": {
         displayName: "Gemini Flash",
-        resolve: "opencode/gemini-3.5-flash",
+        resolve: "opencode/gemini-3.6-flash",
         effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/google/gemini-3.5-flash"
+        openRouterResolve: "openrouter/google/gemini-3.6-flash"
       },
       "kimi-k2": {
         displayName: "Kimi K2",
-        // opencode Zen serves only up to k2.6; the OpenRouter fallback (used for
-        // router/oss proxy runs) takes the newer k2.7-code.
-        resolve: "opencode/kimi-k2.6",
+        resolve: "opencode/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
-      // Zen serves m2.5; the funded OpenRouter path tracks the current m2.7.
+      // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
-        resolve: "opencode/minimax-m2.5",
+        resolve: "opencode/minimax-m2.7",
         openRouterResolve: "openrouter/minimax/minimax-m2.7"
       },
       "gpt-5-nano": {
@@ -509,30 +562,30 @@ var providers = {
       // alias): after the Sol/Terra/Luna rename, ~gpt-mini-latest no longer maps
       // to Luna, so rolling aliases would silently diverge `gpt`/`gpt-mini` from
       // the chosen tiers across funding paths.
-      gpt: {
+      "gpt-sol": {
         displayName: "GPT Sol",
         resolve: "openrouter/openai/gpt-5.6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol",
         subagentModel: "gpt-terra"
       },
-      // see openai/gpt-pro. openrouter serves sol-pro directly on both routes.
-      "gpt-pro": {
+      // see openai/gpt-sol-pro. openrouter serves sol-pro directly on both routes.
+      "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
         resolve: "openrouter/openai/gpt-5.6-sol-pro",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
-        subagentModel: "gpt"
+        subagentModel: "gpt-sol"
       },
-      // gpt-5.6 balanced mid-tier — selectable + `gpt`'s subagent. see openai above.
+      // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "openrouter/openai/gpt-5.6-terra",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/openai/gpt-5.6-terra"
       },
-      "gpt-mini": {
+      "gpt-luna": {
         displayName: "GPT Luna",
         resolve: "openrouter/openai/gpt-5.6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
@@ -543,20 +596,39 @@ var providers = {
         displayName: "GPT Codex",
         resolve: "openrouter/openai/gpt-5.3-codex",
         openRouterResolve: "openrouter/openai/gpt-5.3-codex",
-        fallback: "openrouter/gpt"
+        fallback: "openrouter/gpt-sol"
       },
       "gpt-codex-mini": {
         displayName: "GPT Codex Mini",
         resolve: "openrouter/openai/gpt-5.1-codex-mini",
         openRouterResolve: "openrouter/openai/gpt-5.1-codex-mini",
-        fallback: "openrouter/gpt-mini"
+        fallback: "openrouter/gpt-luna"
+      },
+      // pre-5.6 tier slugs — see openai provider above.
+      gpt: {
+        displayName: "GPT",
+        resolve: "openrouter/openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        fallback: "openrouter/gpt-sol"
       },
-      // dropped hidden subagent tier — folds stored pins forward to gpt (Sol).
+      "gpt-pro": {
+        displayName: "GPT Pro",
+        resolve: "openrouter/openai/gpt-5.6-sol-pro",
+        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        fallback: "openrouter/gpt-sol-pro"
+      },
+      "gpt-mini": {
+        displayName: "GPT Mini",
+        resolve: "openrouter/openai/gpt-5.6-luna",
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna",
+        fallback: "openrouter/gpt-luna"
+      },
+      // dropped hidden subagent tier — folds stored pins forward to Sol.
       "gpt-5.4": {
         displayName: "GPT 5.4",
         resolve: "openrouter/openai/gpt-5.4",
         openRouterResolve: "openrouter/openai/gpt-5.4",
-        fallback: "openrouter/gpt"
+        fallback: "openrouter/gpt-sol"
       },
       "o4-mini": {
         displayName: "O4 Mini",
@@ -579,9 +651,9 @@ var providers = {
       },
       grok: {
         displayName: "Grok",
-        resolve: "openrouter/x-ai/grok-4.3",
-        effort: ["none", "low", "medium", "high"],
-        openRouterResolve: "openrouter/x-ai/grok-4.3"
+        resolve: "openrouter/x-ai/grok-4.5",
+        effort: ["low", "medium", "high"],
+        openRouterResolve: "openrouter/x-ai/grok-4.5"
       },
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
@@ -589,11 +661,13 @@ var providers = {
         effort: ["high", "xhigh"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro"
       },
+      // rolling pointer, not the bare id — see `deepseek/deepseek-flash` for why
+      // OpenRouter's unversioned `deepseek-v4-flash` is the stale April preview.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
-        resolve: "openrouter/deepseek/deepseek-v4-flash",
-        effort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-flash"
+        resolve: "openrouter/~deepseek/deepseek-v4-flash-latest",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/~deepseek/deepseek-v4-flash-latest"
       },
       // legacy alias — deepseek retires this on 2026-07-24; transparently
       // upgrade existing users to the v4 family via the fallback chain.
@@ -688,7 +762,7 @@ var modelAliases = Object.entries(providers).flatMap(
 var AUTO_EFFICIENT = "auto/efficient";
 var AUTO_INTELLIGENT = "auto/intelligent";
 var AUTO_TIER_TARGET = {
-  [AUTO_EFFICIENT]: "deepseek/deepseek-pro",
+  [AUTO_EFFICIENT]: "deepseek/deepseek-flash",
   [AUTO_INTELLIGENT]: "anthropic/claude-opus"
 };
 function isAutoTier(slug) {
@@ -744,6 +818,26 @@ if (!defaultProxyAlias?.openRouterResolve) {
 }
 var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
+var OSS_MODEL_ALLOWLIST = [
+  "deepseek/deepseek-flash",
+  "deepseek/deepseek-pro",
+  "openai/gpt-luna",
+  "openrouter/minimax-m2.5",
+  "moonshotai/kimi-k2"
+];
+var OSS_RECOMMENDED_MODEL = AUTO_TIER_TARGET[AUTO_EFFICIENT];
+var ossAllowedTargets = new Set(
+  OSS_MODEL_ALLOWLIST.map((slug) => {
+    const target = resolveOpenRouterModel(slug);
+    if (!target) throw new Error(`OSS_MODEL_ALLOWLIST: ${slug} has no openRouterResolve`);
+    return target;
+  })
+);
+function isOssAllowedModel(slug) {
+  if (!slug) return false;
+  const target = resolveOpenRouterModel(slug);
+  return target !== void 0 && ossAllowedTargets.has(target);
+}
 function getAutoSelectHintModel() {
   return defaultProxyDisplayName;
 }
@@ -1197,7 +1291,7 @@ function formatModelLabel(params) {
     const ossBase = `\`${displayName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
     if (params.clamped?.reason !== "oss") return ossBase;
     const configured = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
-    return `${ossBase} (${configured} not used \u2014 the program covers this model; add its [provider key](https://docs.pullfrog.com/models) to run your pick)`;
+    return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
   const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
   if (params.fallbackFrom) {
@@ -1597,6 +1691,8 @@ export {
   LEAPING_INTO_ACTION_PREFIX,
   MAX_LEARNINGS_LENGTH,
   OAuthInvalidGrantError,
+  OSS_MODEL_ALLOWLIST,
+  OSS_RECOMMENDED_MODEL,
   PULLFROG_DIVIDER,
   RUN_STATUS_CHECK_NAME,
   TIMEOUT_DISABLED,
@@ -1619,6 +1715,7 @@ export {
   isCardGatedModel,
   isEffortPosition,
   isLeapingIntoActionCommentBody,
+  isOssAllowedModel,
   isPullfrog,
   isValidTimeString,
   modelAliases,

package/dist/mcp/shell.d.ts

@@ -1,12 +1,12 @@
 import type { ToolContext } from "./server.ts";
 export declare const ShellParams: import("arktype/internal/variants/object.ts").ObjectType<{
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;
 }, {}>;
-export type SandboxMethod = "unshare" | "sudo-unshare" | "none";
+export type SandboxMethod = "unshare" | "sudo-unshare" | "userns-unshare" | "none";
 /** get the current sandbox method (for testing/diagnostics) */
 export declare function getSandboxMethod(): SandboxMethod;
 /** chars of shell output kept inline in the agent reply. anything past this
@@ -16,13 +16,13 @@ export declare function getSandboxMethod(): SandboxMethod;
 export declare const MAX_OUTPUT_CHARS = 5000;
 export declare function ShellTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;
 }, {
     command: string;
-    description: string;
+    description?: string;
     timeout?: number;
     working_directory?: string;
     background?: boolean;

package/dist/models.d.ts

@@ -145,11 +145,11 @@ export declare const modelAliases: ModelAlias[];
  * concrete alias by `resolveDisplayAlias` below, so every downstream consumer
  * (CLI resolve, OpenRouter resolve, footer label) handles them transparently.
  *
- * `efficient` mirrors the OSS/default subsidy model (DeepSeek V4 Pro — beats
- * Kimi K2.7 on agentic-review quality at ~4-5x lower cost, run at whatever
- * effort the repo asks for, clamped to its published ladder); `intelligent` is the
- * frontier pick (Claude Opus). a `null` model means the tier hasn't been
- * pinned: callers default by card status via `defaultAutoTier`.
+ * `efficient` mirrors the OSS/default subsidy model (DeepSeek Flash — the 0731
+ * release is DeepSeek's first officially-shipped V4, where Pro is still the
+ * April preview, and it costs ~0.45x Pro on our cache-heavy review workload);
+ * `intelligent` is the frontier pick (Claude Opus). a `null` model means the
+ * tier hasn't been pinned: callers default by card status via `defaultAutoTier`.
  */
 export declare const AUTO_EFFICIENT = "auto/efficient";
 export declare const AUTO_INTELLIGENT = "auto/intelligent";
@@ -235,6 +235,30 @@ export declare function resolveModelRung(params: {
     useOpenRouter: boolean;
 }): string | undefined;
 export declare const DEFAULT_PROXY_MODEL: string;
+/**
+ * the models Pullfrog is willing to fund on the OSS program. an accepted OSS
+ * repo may pick any of these and run-context honors the pick; anything else
+ * falls back to `DEFAULT_PROXY_MODEL`, so a subsidized run can never land on a
+ * frontier model.
+ *
+ * membership is a spend decision, so it lives here as a literal rather than a
+ * DB toggle — changing it is a deploy, which is the right friction. costs below
+ * are modelled on the measured OSS token mix, where cache reads are ~87.5% of
+ * input and list price therefore ranks models WRONG: Luna 0.39x, Flash 0.45x,
+ * Pro 1.00x, MiniMax M2 1.30x, Kimi 3.88x modelled — but 7.25x as actually
+ * measured over the pre-#1063 Kimi era, which is the number to trust.
+ */
+export declare const OSS_MODEL_ALLOWLIST: readonly string[];
+/** the pick the console badges. DERIVED from the efficient tier rather than
+ * restated, so the badge cannot drift from the model that actually runs — a
+ * second literal here would be an invariant nothing enforces. */
+export declare const OSS_RECOMMENDED_MODEL: string;
+/**
+ * whether an OSS repo's stored pick is one the program funds. resolves through
+ * the fallback chain first, so `auto/*` sentinels and deprecated slugs are
+ * judged by the model that actually runs.
+ */
+export declare function isOssAllowedModel(slug: string | null | undefined): slug is string;
 /** short label for the model auto-select picks today (console hint copy). */
 export declare function getAutoSelectHintModel(): string;
 /** env var that supplies the Bedrock model ID for the `bedrock/byok` slug. */

package/dist/utils/apiKeys.d.ts

@@ -53,15 +53,19 @@ export declare function validateAgentApiKey(params: {
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**
- * Expired OAuth-connection credential shapes (#931) — the fix is to
- * re-authenticate the provider connection (`pullfrog auth <provider>`), not
- * to rotate a repo-secret API key, so `formatApiKeyErrorSummary` renders
- * distinct copy for these. Patterns are deliberately narrow:
- * "authentication token has expired" (not bare "token has expired") so a
- * GitHub installation-token expiry can't be misread as an LLM key problem.
- * also covers server-side revocation ("authentication token has been
- * invalidated", OpenAI `token_invalidated`, #1041) and the Claude CLI's
- * "OAuth access token has expired" phrasing (#1072) — same remediation.
+ * Dead OAuth-connection credential — the provider is telling us the token
+ * itself is finished (expired, invalidated, revoked, or unrecognised), and the
+ * only fix is to re-authenticate the connection (`pullfrog auth <provider>`),
+ * never to rotate a repo-secret API key. `formatApiKeyErrorSummary` renders
+ * distinct copy for the whole class.
+ *
+ * Match the SHAPE, not the sentence. Four prior issues (#931, #1041, #1072,
+ * #1122) each landed one more literal and the next provider rewording walked
+ * straight through, so these patterns are parameterised over the two things
+ * that vary — which token noun the provider uses, and which terminal state it
+ * reports. Still deliberately narrow on the noun ("authentication token" /
+ * "OAuth access token", never bare "token") so a GitHub installation-token
+ * expiry can't be misread as an LLM credential problem.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
 /**
@@ -70,6 +74,7 @@ export declare function isOAuthCredentialExpiredError(text: string): boolean;
  * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
  */
 export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
+export declare function isClaudeSessionLimitError(text: string): boolean;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/gitAuth.d.ts

@@ -17,7 +17,20 @@ type SafeGitSubcommand = "fetch" | "push";
 type GitAuthOptions = {
     token: string;
     cwd?: string;
+    /**
+     * re-mint the git token when GitHub hands out one its git edge never accepts.
+     * when present, an auth-class failure is retried ONCE with a fresh token.
+     */
+    refreshGitToken?: ((stale: string) => Promise<string>) | undefined;
 };
+/**
+ * installation-token 401s on git. GitHub intermittently mints a token its git
+ * edge never accepts, so retrying the SAME token never recovers — only a
+ * re-mint does. lives here rather than next to `classifyPushError` in
+ * `mcp/git.ts` because the fetch path needs it too and `git.ts` imports this
+ * module, not the other way round. see #1115.
+ */
+export declare const TRANSIENT_AUTH_PATTERNS: RegExp[];
 type GitResult = {
     stdout: string;
     stderr: string;

package/dist/utils/modelAccess.d.ts

@@ -34,8 +34,10 @@ export type ModelAccessDecision = {
  * decide whether an (already-resolved) requested model can run, and how.
  *
  * - non-explicit / no model → `ok` (caller's missing-key validation applies).
- * - proxy active + OSS → only the funded subsidy target routes; a different
- *   model needs the repo's own key (`byok`) else `error("oss")`.
+ * - proxy active + OSS → the funded subsidy target and anything else on
+ *   `OSS_MODEL_ALLOWLIST` route; a model off the list needs the repo's own key
+ *   (`byok`) else `error("oss")`. the allowlist arm is what keeps
+ *   `--model=<allowlisted>` from hard-failing on a pick the console offers.
  * - proxy active + Router → honor any Router-servable model (`proxy`); fall to
  *   BYOK when locally authorized, else `error("router")`.
  * - no proxy → the resolved model must be locally authorized, else

package/dist/utils/packageManager.d.ts

@@ -47,3 +47,25 @@ export interface EnsurePackageManagerParams {
  * still works; we just don't get our version guarantee.
  */
 export declare function ensurePackageManager(params: EnsurePackageManagerParams): Promise<boolean>;
+/** `SupportedPackageManager` plus deno, which corepack never manages. */
+export type ProvisionablePackageManager = SupportedPackageManager | "deno";
+/**
+ * Put the project's package manager on PATH, by whichever route provisions it —
+ * corepack for pnpm/yarn, `npm i -g` for bun, the install script for deno.
+ * Returns an error string on failure, else null.
+ *
+ * Callers must gate this on shell being enabled; provisioning executes code.
+ *
+ * Idempotent by construction (`isCommandAvailable` short-circuits and
+ * `ensurePackageManager` caches on a `--version` match), which is what lets
+ * `main.ts` call it BEFORE the `setup` lifecycle hook and the prep phase call it
+ * again later for the cost of one `which`. That ordering is the point: a `setup`
+ * hook running `bun install` used to die with `bun: command not found` 0.8s
+ * before Pullfrog installed bun itself, because the pre-hook site only ever
+ * asked corepack — which ignores bun and deno entirely. See #1121.
+ */
+export declare function provisionPackageManager(params: {
+    name: ProvisionablePackageManager;
+    declared: PackageManagerSpec | null;
+    binDir: string;
+}): Promise<string | null>;