pullfrog 0.1.64 → 0.1.65

package/dist/internal.js

@@ -185,7 +185,12 @@ var providers = {
         displayName: "O3",
         resolve: "openai/o3",
         effort: ["low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/o3"
+        openRouterResolve: "openrouter/openai/o3",
+        // OpenRouter publishes a reasoning TOGGLE for o3 where direct OpenAI
+        // publishes a ladder, so the route genuinely has no rungs. `[]` rather
+        // than omitting the field: an absent openRouterEffort falls through to
+        // `effort` and would send a rung this route rejects.
+        openRouterEffort: []
       }
     }
   }),
@@ -350,14 +355,19 @@ var providers = {
         effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-opus-5",
         subagentModel: "claude-sonnet",
-        // TEMPORARY — clear this when Zen serves opus again. Zen still LISTS
-        // claude-opus-5 in /zen/v1/models, so the catalog test passes, but the
-        // endpoint answers 503 `Upstream request failed: Endpoint is
-        // unavailable.` (measured 5/5; claude-sonnet-5, claude-opus-4-8,
-        // claude-haiku-4-5 and claude-fable-5 all 200 on the same key). opencode
-        // retries the 503 above the AI SDK emitting no part.updated, so a run
-        // just produces nothing until it is killed — metaideas/init logged six
-        // zero-output failures from 2026-08-23. see wiki/opencode-silent-stall.md
+        // TEMPORARY — clear this ONLY when opus completes a run through opencode,
+        // never when the endpoint merely answers. Zen LISTS claude-opus-5 in
+        // /zen/v1/models, so the catalog test passes; on 2026-08-25 the endpoint
+        // itself answered 503 `Upstream request failed: Endpoint is unavailable.`
+        // (measured 5/5; claude-sonnet-5, claude-opus-4-8, claude-haiku-4-5 and
+        // claude-fable-5 all 200 on the same key). opencode retries above the AI
+        // SDK emitting no part.updated, so a run just produces nothing until it is
+        // killed — metaideas/init logged six zero-output failures from 2026-08-23.
+        // The 503 has since cleared and the model is STILL unusable: re-measured
+        // 2026-08-26, direct POST /zen/v1/messages is 10/10 200 at 1.3-4.1s while
+        // `opencode run --model opencode/claude-opus-5` on the same trivial prompt
+        // emitted nothing for 240s in CI. A raw-endpoint 200 is not runtime
+        // availability. see wiki/opencode-silent-stall.md
         fallback: "opencode/claude-sonnet"
       },
       "claude-sonnet": {
@@ -488,22 +498,139 @@ var providers = {
       }
     }
   }),
+  // OpenCode Go is a separate $10/mo subscription from Zen, served on its own
+  // base URL (`https://opencode.ai/zen/go/v1`) but authenticated with the SAME
+  // `OPENCODE_API_KEY`. it carries the open-weight coding models plus a couple
+  // of frontier ones, and 14 of the ids below are served ONLY here — Zen's
+  // `/v1/models` does not list glm-5.3*, qwen3.7/3.8-*, mimo-*, longcat-2.0,
+  // hy3 or muse-spark. so for a Go subscriber this provider is not a duplicate
+  // route to Zen, it is the only route to most of what they pay for.
+  // like `opencode` and `openrouter` this is a ROUTER, not a vendor: slugs and
+  // display names mirror the upstream brand tier, and the picker groups them
+  // under the upstream vendor.
   "opencode-go": provider({
     displayName: "OpenCode Go",
     envVars: ["OPENCODE_API_KEY"],
     models: {
+      // Z.ai — the plan's flagship coding family, and the only route the
+      // catalog offers to GLM at all.
+      glm: {
+        displayName: "GLM",
+        resolve: "opencode-go/glm-5.3",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/z-ai/glm-5.3",
+        preferred: true,
+        subagentModel: "glm-flash"
+      },
+      "glm-flash": {
+        displayName: "GLM Flash",
+        resolve: "opencode-go/glm-5.3-flash",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/z-ai/glm-5.3-flash"
+      },
+      // legacy alias — the slug pinned a version instead of a brand tier and
+      // was already resolving to 5.2 under a "GLM 5.2" label. folds forward to
+      // the tier slug; 16 repos and 9 accounts still hold it.
       "glm-5.1": {
         displayName: "GLM 5.2",
         resolve: "opencode-go/glm-5.2",
         effort: ["high", "max"],
         openRouterEffort: ["high", "xhigh"],
         openRouterResolve: "openrouter/z-ai/glm-5.2",
-        preferred: true
+        fallback: "opencode-go/glm"
+      },
+      // Moonshot — parity with moonshotai/* and openrouter/*.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "opencode-go/kimi-k3",
+        // Go publishes a single rung for K3 where the OpenRouter route
+        // publishes three, so every position lands on `max` here.
+        effort: ["max"],
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        subagentModel: "kimi-k2"
       },
       "kimi-k2": {
         displayName: "Kimi K2",
         resolve: "opencode-go/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
+      },
+      // DeepSeek and Muse Spark are deliberately ABSENT even though Go serves
+      // them and prices DeepSeek Pro below Zen. each sits behind a per-workspace
+      // opt-in that is off by default — measured, the run dies with
+      // `RegionError` ("only available hosted in China") and `DataPolicyError`
+      // ("collects data used to improve its quality"). that toggle lives on the
+      // CUSTOMER's OpenCode workspace, so no change here can satisfy it, and a
+      // picker row that fails for almost everyone is worse than none. DeepSeek
+      // stays reachable ungated via `deepseek/*`, `opencode/*` and
+      // `openrouter/*`; both remain runnable by full specifier once opted in.
+      // Alibaba — new vendor family for the catalog; Zen serves neither tier.
+      "qwen-max": {
+        displayName: "Qwen Max",
+        resolve: "opencode-go/qwen3.8-max",
+        // both routes publish rungs, and they are different sets rather than
+        // different spellings of one — OpenRouter carries a `minimal` and a
+        // `high` the Go route does not.
+        effort: ["low", "medium", "xhigh"],
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/qwen/qwen3.8-max"
+      },
+      "qwen-plus": {
+        displayName: "Qwen Plus",
+        resolve: "opencode-go/qwen3.7-plus",
+        openRouterResolve: "openrouter/qwen/qwen3.7-plus"
+      },
+      // MiniMax — parity with opencode/* and openrouter/*; the m2 slug pins the
+      // line for DB stability while the resolve tracks the current m2.7.
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "opencode-go/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
+      },
+      "minimax-m2.5": {
+        displayName: "MiniMax M2",
+        resolve: "opencode-go/minimax-m2.7",
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+      },
+      // Xiaomi — Go-only; Zen serves the free `mimo-v2-pro-free` promo instead.
+      "mimo-pro": {
+        displayName: "MiMo Pro",
+        resolve: "opencode-go/mimo-v2.5-pro",
+        openRouterResolve: "openrouter/xiaomi/mimo-v2.5-pro"
+      },
+      // Meituan — Go-only.
+      longcat: {
+        displayName: "LongCat",
+        resolve: "opencode-go/longcat-2.0",
+        openRouterResolve: "openrouter/meituan/longcat-2.0"
+      },
+      // Tencent — Go-only, and the cheapest model on the plan by an order of
+      // magnitude (0.0175/0.0725). Hy3 succeeds the Hunyuan 2.0 line, so the
+      // generation is part of the product name the way Kimi K2/K3 is.
+      hy3: {
+        displayName: "Hy3",
+        resolve: "opencode-go/hy3",
+        effort: ["none", "low", "high"],
+        openRouterResolve: "openrouter/tencent/hy3"
+      },
+      // xAI and OpenAI — the two non-open models on the plan. same list price as
+      // Zen, but a Go subscription covers them where Zen meters them.
+      // Go is the only route that has retired grok-4.5 (models.dev marks
+      // `opencode-go/grok-4.5` deprecated while every other provider still
+      // serves it), so this alias LEADS `xai/grok` by a generation. a mirror
+      // that leads is safe; it is the trailing case that rots — see
+      // wiki/models-catalog.md on `opencode/kimi-k2`.
+      grok: {
+        displayName: "Grok",
+        resolve: "opencode-go/grok-4.6",
+        effort: ["low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/x-ai/grok-4.6"
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "opencode-go/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
       }
     }
   }),
@@ -680,7 +807,6 @@ var providers = {
       "o4-mini": {
         displayName: "O4 Mini",
         resolve: "openrouter/openai/o4-mini",
-        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/openai/o4-mini"
       },
       "gemini-pro": {

package/dist/models.d.ts

@@ -68,7 +68,8 @@ export interface ModelAlias {
     effort: readonly string[] | undefined;
     /** effort rungs on the OpenRouter route, when they differ from `effort` (the
      * DeepSeek/GLM top rung is `max` natively but `xhigh` via OpenRouter).
-     * undefined falls back to `effort`. */
+     * undefined falls back to `effort`; `[]` says the OpenRouter route publishes
+     * no rungs at all, which undefined cannot express. */
     openRouterEffort: readonly string[] | undefined;
     /** hide from selectable lists (UI dropdowns, CLI pickers). does NOT affect
      * resolution — for that use `fallback`. used to keep a redundant alias out of

package/dist/toolState.d.ts

@@ -26,7 +26,7 @@ export type StoredPushDest = {
  * Lives here (not in `mcp/review.ts`) so `ToolState` — which caches
  * `Map<path, CommentableLines>` per checkout — does not pull the MCP server
  * graph into every consumer of run state (the action's main loop, agent
- * harnesses, cf-worker indexing).
+ * harnesses).
  */
 export type CommentableLines = {
     RIGHT: Set<number>;

package/dist/utils/apiKeys.d.ts

@@ -1,3 +1,25 @@
+/** shared sentence in the four `resolveSlug` routing-slug throws. */
+export declare const BYOK_SLUG_MARKER = "env var is required when the model is set to";
+/** shared sentence in the four `validate*Setup` throws. */
+export declare const BYOK_CONFIG_MARKER = "selected but required configuration is missing:";
+/**
+ * A BYOK provider setup is incomplete, at either of the two points that catch it:
+ * `resolveSlug` refusing a routing slug whose backing env var is unset, and the
+ * per-provider `validate*Setup` check that runs once the slug resolves. All eight
+ * messages already name what is missing, the remedy and a docs page, so the
+ * renderer passes them through rather than rewriting them. Before this they
+ * matched no branch at all, and `renderRunError` writes `errorMessage` to the job
+ * summary but not to the comment — so the answer existed on every one of these
+ * runs and the customer's PR comment read `Run failed.`
+ *
+ * Matched from character zero rather than searched anywhere in the text, because
+ * a match publishes the WHOLE message verbatim to a customer's PR and
+ * `errorMessage` is not always ours: `postRun` builds one out of a repo's own
+ * stop-hook output, which is arbitrary text the customer's script printed. A
+ * message that merely CONTAINS one of these errors is something quoting us, and
+ * passing it through would republish everything around it.
+ */
+export declare function isByokSetupError(text: string): boolean;
 /**
  * marker for the distinct "run-context couldn't hand over your stored secrets"
  * body. surfaced verbatim by `runErrorRenderer` (same contract as
@@ -73,6 +95,14 @@ export declare function validateAgentApiKey(params: {
  *   - org-disabled Claude subscription (#1072): `Your organization has
  *     disabled Claude subscription access for Claude Code`, an entitlement
  *     denial with its own remedy — see isClaudeSubscriptionDisabledError.
+ *   - OpenAI rejected key: `Incorrect API key provided: sk-proj-***`, OpenAI's
+ *     own wording for a revoked, rotated or wrong-project key. Absent from this
+ *     list every such run rendered the generic one-line "Run failed." with no
+ *     cause at all — measured on two accounts sitting at 100% failure, one of
+ *     them for a week. Matched on the full phrase rather than "Incorrect API
+ *     key" alone for the reason the markers above are phrased distinctively:
+ *     this predicate short-circuits the whole rendering pipeline on a substring
+ *     of arbitrary agent output.
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**

package/dist/utils/globals.d.ts

@@ -1,3 +1,2 @@
-export declare const isCloudflareSandbox: boolean;
 export declare const isGitHubActions: boolean;
 export declare const isInsideDocker: boolean;

package/dist/utils/learnings.d.ts

@@ -57,11 +57,7 @@ export declare function readLearningsFile(path: string): Promise<string | null>;
  * Best-effort: any failure is logged and does not affect the run's success
  * status. Skips the PATCH when the file is byte-trim-identical to its seed —
  * the agent didn't touch it, so writing the same content back would just
- * burn a `LearningsRevision` row and an API round-trip.
- *
- * `ctx.toolState.model` is forwarded so `LearningsRevision.model` keeps
- * populating; it powers the per-revision attribution badge in the UI
- * history view.
+ * burn an API round-trip.
  *
  * `learningsPersistAttempted` guards against double-execution between the
  * normal end-of-run path and the SIGINT/SIGTERM handler.

package/dist/utils/learningsTruncate.d.ts

@@ -5,8 +5,8 @@
  * `action/internal/index.ts` without dragging the entire MCP type graph
  * along — `learnings.ts` imports `ToolContext` for its runtime helpers,
  * and pulling that into the SDK-facing `internal` barrel expands the
- * type graph reachable from root `tsc` and `cf-worker-indexing` to every
- * tool module under `action/mcp/`. keeping these helpers MCP-free is the
+ * type graph reachable from root `tsc` to every tool module under
+ * `action/mcp/`. keeping these helpers MCP-free is the
  * cheap structural fix.
  *
  * see `action/utils/learnings.ts` for the full learnings-file lifecycle.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",