pullfrog 0.1.66 → 0.1.67

package/README.md

@@ -98,6 +98,7 @@ jobs:
           DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
+          KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
 
 ```
 

package/dist/cli.mjs

@@ -525,15 +525,15 @@ var require_file_command = __commonJS({
     }
     exports.issueFileCommand = issueFileCommand;
     function prepareKeyValueMessage(key, value2) {
-      const delimiter2 = `ghadelimiter_${crypto5.randomUUID()}`;
+      const delimiter3 = `ghadelimiter_${crypto5.randomUUID()}`;
       const convertedValue = (0, utils_1.toCommandValue)(value2);
-      if (key.includes(delimiter2)) {
-        throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter2}"`);
+      if (key.includes(delimiter3)) {
+        throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter3}"`);
       }
-      if (convertedValue.includes(delimiter2)) {
-        throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter2}"`);
+      if (convertedValue.includes(delimiter3)) {
+        throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter3}"`);
       }
-      return `${key}<<${delimiter2}${os2.EOL}${convertedValue}${os2.EOL}${delimiter2}`;
+      return `${key}<<${delimiter3}${os2.EOL}${convertedValue}${os2.EOL}${delimiter3}`;
     }
     exports.prepareKeyValueMessage = prepareKeyValueMessage;
   }
@@ -11973,10 +11973,10 @@ var require_headers = __commonJS({
         const lowercaseName = name.toLowerCase();
         const exists = this[kHeadersMap].get(lowercaseName);
         if (exists) {
-          const delimiter2 = lowercaseName === "cookie" ? "; " : ", ";
+          const delimiter3 = lowercaseName === "cookie" ? "; " : ", ";
           this[kHeadersMap].set(lowercaseName, {
             name: exists.name,
-            value: `${exists.value}${delimiter2}${value2}`
+            value: `${exists.value}${delimiter3}${value2}`
           });
         } else {
           this[kHeadersMap].set(lowercaseName, { name, value: value2 });
@@ -46981,10 +46981,10 @@ var require_headers2 = __commonJS({
         const lowercaseName = isLowerCase ? name : name.toLowerCase();
         const exists = this.headersMap.get(lowercaseName);
         if (exists) {
-          const delimiter2 = lowercaseName === "cookie" ? "; " : ", ";
+          const delimiter3 = lowercaseName === "cookie" ? "; " : ", ";
           this.headersMap.set(lowercaseName, {
             name: exists.name,
-            value: `${exists.value}${delimiter2}${value2}`
+            value: `${exists.value}${delimiter3}${value2}`
           });
         } else {
           this.headersMap.set(lowercaseName, { name, value: value2 });
@@ -59293,8 +59293,8 @@ var init_regexes = __esm({
     _emoji = `^[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
     ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    mac = (delimiter2) => {
-      const escapedDelim = escapeRegex(delimiter2 ?? ":");
+    mac = (delimiter3) => {
+      const escapedDelim = escapeRegex(delimiter3 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -102436,10 +102436,10 @@ var require_turndown_cjs = __commonJS({
         if (!content) return "";
         content = content.replace(/\r?\n|\r/g, " ");
         var extraSpace = /^`|^ .*?[^ ].* $|`$/.test(content) ? " " : "";
-        var delimiter2 = "`";
+        var delimiter3 = "`";
         var matches = content.match(/`+/gm) || [];
-        while (matches.indexOf(delimiter2) !== -1) delimiter2 = delimiter2 + "`";
-        return delimiter2 + extraSpace + content + extraSpace + delimiter2;
+        while (matches.indexOf(delimiter3) !== -1) delimiter3 = delimiter3 + "`";
+        return delimiter3 + extraSpace + content + extraSpace + delimiter3;
       }
     };
     rules.image = {
@@ -104189,8 +104189,8 @@ var require_common = __commonJS({
         }
         return debug4;
       }
-      function extend3(namespace, delimiter2) {
-        const newDebug = createDebug(this.namespace + (typeof delimiter2 === "undefined" ? ":" : delimiter2) + namespace);
+      function extend3(namespace, delimiter3) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter3 === "undefined" ? ":" : delimiter3) + namespace);
         newDebug.log = this.log;
         return newDebug;
       }
@@ -108809,9 +108809,9 @@ var import_picocolors2 = __toESM(require_picocolors(), 1);
 
 // utils/codexAuth.ts
 import { spawn } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 
 // utils/oauthShared.ts
 var OAuthInvalidGrantError = class extends Error {
@@ -108960,11 +108960,60 @@ async function mintCodexAuth(options) {
   }
 }
 var SIGTERM_GRACE_MS = 5e3;
+var DEVICE_AUTH_ARGS = ["login", "--device-auth"];
+var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+function envValue(env2, name) {
+  if (env2[name] !== void 0) return env2[name];
+  const key = Object.keys(env2).find((candidate) => candidate.toUpperCase() === name.toUpperCase());
+  return key === void 0 ? void 0 : env2[key];
+}
+function commandProcessor(env2) {
+  return envValue(env2, "ComSpec") ?? join(envValue(env2, "SystemRoot") ?? "C:\\Windows", "system32", "cmd.exe");
+}
+function resolveSpawnTarget(params) {
+  if (process.platform !== "win32") {
+    return { file: params.command, args: params.args, wrapped: false };
+  }
+  const extensions2 = (envValue(params.env, "PATHEXT") ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
+  for (const directory of (envValue(params.env, "PATH") ?? "").split(delimiter).filter(Boolean)) {
+    for (const extension of extensions2) {
+      const candidate = join(directory, `${params.command}${extension.toLowerCase()}`);
+      if (!existsSync(candidate)) continue;
+      if (!/\.(cmd|bat)$/i.test(candidate)) {
+        return { file: candidate, args: params.args, wrapped: false };
+      }
+      const command = [`"${candidate}"`, ...params.args].join(" ");
+      return {
+        file: commandProcessor(params.env),
+        args: ["/d", "/s", "/c", `"${command}"`],
+        wrapped: true
+      };
+    }
+  }
+  return null;
+}
+function codexNotFoundMessage(env2) {
+  const install = "install it with `npm i -g @openai/codex` or see https://developers.openai.com/codex/cli for other install options.";
+  if (process.platform !== "win32") return `codex CLI not found on PATH. ${install}`;
+  const extensions2 = (envValue(env2, "PATHEXT") ?? DEFAULT_PATHEXT).split(";").filter(Boolean).join(" ");
+  return `codex CLI not found on PATH (searched every PATH entry for codex with ${extensions2}). a working \`codex --version\` in a shell does not prove Node can spawn it. ${install}`;
+}
 function runDeviceAuth(input2) {
   return new Promise((resolve3, reject) => {
-    const child = spawn("codex", ["login", "--device-auth"], {
+    const target = resolveSpawnTarget({
+      command: "codex",
+      args: DEVICE_AUTH_ARGS,
+      env: process.env
+    });
+    if (!target) {
+      reject(new Error(codexNotFoundMessage(process.env)));
+      return;
+    }
+    const child = spawn(target.file, target.args, {
       env: { ...process.env, CODEX_HOME: input2.codexHome },
-      stdio: ["ignore", input2.childStdio, input2.childStdio]
+      stdio: ["ignore", input2.childStdio, input2.childStdio],
+      windowsVerbatimArguments: target.wrapped,
+      windowsHide: true
     });
     if (input2.childStdio === "pipe") {
       const onLine = input2.onChildLine ?? (() => {
@@ -108976,6 +109025,10 @@ function runDeviceAuth(input2) {
     let timedOut = false;
     const timeoutTimer = setTimeout(() => {
       timedOut = true;
+      if (target.wrapped && child.pid) {
+        spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
+        return;
+      }
       child.kill("SIGTERM");
       killTimer = setTimeout(() => child.kill("SIGKILL"), SIGTERM_GRACE_MS);
     }, input2.timeoutMs);
@@ -108983,7 +109036,7 @@ function runDeviceAuth(input2) {
       clearTimeout(timeoutTimer);
       if (killTimer) clearTimeout(killTimer);
       const errno = err;
-      const message = errno.code === "ENOENT" ? "codex CLI not found on PATH. install it with `npm i -g @openai/codex` or see https://developers.openai.com/codex/cli for other install options." : `failed to spawn codex: ${errno.message}`;
+      const message = errno.code === "ENOENT" ? codexNotFoundMessage(process.env) : `failed to spawn codex: ${errno.message}`;
       reject(new Error(message));
     });
     child.on("close", (code, signal) => {
@@ -109797,7 +109850,7 @@ var import_arg2 = __toESM(require_arg(), 1);
 import { dirname as dirname6 } from "node:path";
 
 // main.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join28 } from "node:path";
 
@@ -110479,6 +110532,69 @@ var providers = {
       }
     }
   }),
+  // the same models as `moonshotai` above, billed against a Kimi membership
+  // instead of a Moonshot API balance — a separate endpoint, separate model
+  // ids and a separate key, which is why it is a provider rather than a second
+  // `envVars` entry. no provider injection is needed: models.dev carries
+  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
+  // ids list in `opencode models` and a run reaches Kimi's own auth check.
+  //
+  // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
+  // membership, so a Router path here would silently bill the wallet for
+  // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
+  // absence is load-bearing: `isCardGatedModel` reads it as "not Router-
+  // resolvable", `decideModelAccess` answers an explicit pick with the
+  // `router` copy ("add your own provider key"), and run-context clamps a
+  // keyless Router pick to the default subsidy model with `noRouterPath`.
+  "kimi-for-coding": provider({
+    // "Kimi Code" is the product name on kimi.com/code and in the console the
+    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
+    // is models.dev's id, so it is what `enabled_providers` and every
+    // `resolve` prefix must spell.
+    displayName: "Kimi Code",
+    envVars: ["KIMI_API_KEY"],
+    models: {
+      // the tier each model needs is in `description` because Kimi answers an
+      // out-of-tier request with 401 — indistinguishable from a bad key by
+      // status alone, and only `isKimiPlanTierError` tells them apart after the
+      // fact. saying it in the picker is the half that stops the run happening.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
+        resolve: "kimi-for-coding/k3",
+        effort: ["low", "high", "max"],
+        subagentModel: "kimi-k2"
+      },
+      // `preferred` sits on the 256K variant rather than the 1M flagship, which
+      // inverts the usual "top tier wins" rule for a reason specific to Kimi:
+      // below Allegretto the two are the SAME 256K ceiling and `k3` charges
+      // roughly double the quota for it, so on the median tier the flagship is
+      // strictly dominated rather than merely pricier. This flag seeds the
+      // onboarding pick (`getRecommendedSlug`) and wins key-only auto-select
+      // (`autoSelectModel`), which are exactly the two moments nobody has
+      // chosen yet.
+      "kimi-k3-256k": {
+        displayName: "Kimi K3 256K",
+        description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
+        resolve: "kimi-for-coding/k3-256k",
+        effort: ["low", "high", "max"],
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
+      "kimi-k2": {
+        displayName: "Kimi K2",
+        description: "Included in every Kimi membership tier",
+        resolve: "kimi-for-coding/kimi-for-coding"
+      },
+      "kimi-k2-highspeed": {
+        displayName: "Kimi K2 HighSpeed",
+        description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
+        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+      }
+    }
+  }),
   opencode: provider({
     displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
@@ -111031,6 +111147,80 @@ var providers = {
         openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
+  }),
+  vercel: provider({
+    // Vercel AI Gateway — one key serves every model it fronts. model IDs use
+    // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
+    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
+    // catalog's entries, not the upstream vendor's. deliberately no
+    // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
+    // over the Router proxy would bill the wallet for traffic the user pointed
+    // at their own gateway.
+    displayName: "Vercel AI Gateway",
+    envVars: ["AI_GATEWAY_API_KEY"],
+    models: {
+      "claude-opus": {
+        displayName: "Claude Opus",
+        resolve: "vercel/anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        preferred: true,
+        subagentModel: "claude-sonnet"
+      },
+      "claude-sonnet": {
+        displayName: "Claude Sonnet",
+        resolve: "vercel/anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh"]
+      },
+      "claude-haiku": {
+        displayName: "Claude Haiku",
+        resolve: "vercel/anthropic/claude-haiku-4.5"
+      },
+      "gpt-sol": {
+        displayName: "GPT Sol",
+        resolve: "vercel/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        subagentModel: "gpt-terra"
+      },
+      "gpt-terra": {
+        displayName: "GPT Terra",
+        resolve: "vercel/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "vercel/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gemini-pro": {
+        displayName: "Gemini Pro",
+        resolve: "vercel/google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"]
+      },
+      "gemini-flash": {
+        displayName: "Gemini Flash",
+        resolve: "vercel/google/gemini-3.6-flash",
+        effort: ["minimal", "low", "medium", "high"]
+      },
+      "deepseek-pro": {
+        displayName: "DeepSeek Pro",
+        resolve: "vercel/deepseek/deepseek-v4-pro-0813",
+        effort: ["high", "xhigh"]
+      },
+      "deepseek-flash": {
+        displayName: "DeepSeek Flash",
+        resolve: "vercel/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"]
+      },
+      glm: {
+        displayName: "GLM",
+        resolve: "vercel/zai/glm-5.3",
+        effort: ["low", "high", "max"]
+      },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "vercel/moonshotai/kimi-k3"
+      }
+    }
   })
 };
 function parseModel(slug2) {
@@ -111458,9 +111648,9 @@ function logTokenTable(t2) {
 }
 
 // utils/globals.ts
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 var isGitHubActions = !!process.env.GITHUB_ACTIONS;
-var isInsideDocker = existsSync("/.dockerenv");
+var isInsideDocker = existsSync2("/.dockerenv");
 
 // utils/log.ts
 var logContext = new AsyncLocalStorage();
@@ -111688,7 +111878,7 @@ function formatUsageSummary(entries) {
 
 // utils/install.ts
 import { spawnSync } from "node:child_process";
-import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync } from "node:fs";
+import { chmodSync, createWriteStream, existsSync as existsSync3, mkdirSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { pipeline } from "node:stream/promises";
 async function installFromNpmTarball(params) {
@@ -111697,7 +111887,7 @@ async function installFromNpmTarball(params) {
   const packageRoot = join2(tempDir, `npm-${params.packageName.replace(/[^a-z0-9]+/gi, "-")}`);
   const extractedDir = join2(packageRoot, "package");
   const cliPath = join2(extractedDir, params.executablePath);
-  if (existsSync2(cliPath)) {
+  if (existsSync3(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -111771,7 +111961,7 @@ async function installFromNpmTarball(params) {
     }
     log2.debug(`\xBB dependencies installed`);
   }
-  if (!existsSync2(cliPath)) {
+  if (!existsSync3(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   chmodSync(cliPath, 493);
@@ -111978,7 +112168,7 @@ function resolveRunEffort(ctx) {
 
 // utils/skills.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -111989,7 +112179,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.66",
+  version: "0.1.67",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -112118,7 +112308,7 @@ function resolveSkillPath(name) {
     join3(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate)) return candidate;
+    if (existsSync4(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
@@ -114159,13 +114349,13 @@ var claude = agent({
 
 // agents/codex.ts
 var core2 = __toESM(require_core(), 1);
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 
 // utils/codexHome.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir2, userInfo } from "node:os";
 import { join as join6 } from "node:path";
 var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
@@ -114214,7 +114404,7 @@ function installCodexAuth() {
 }
 function writeOpenCodeAuthEntry(params) {
   let existing = {};
-  if (existsSync4(params.authPath)) {
+  if (existsSync5(params.authPath)) {
     try {
       const parsed2 = JSON.parse(readFileSync3(params.authPath, "utf8"));
       if (parsed2 && typeof parsed2 === "object") existing = parsed2;
@@ -114531,7 +114721,7 @@ var APPROVAL_MODE_KEY = "default_tools_approval_mode";
 var APPROVE_TOOLS = `${APPROVAL_MODE_KEY} = "approve"`;
 function repoMcpApprovals(repoDir) {
   const path4 = join7(repoDir, ".codex", "config.toml");
-  if (!existsSync5(path4)) return [];
+  if (!existsSync6(path4)) return [];
   const out = [];
   let section = [];
   let isServerTable = false;
@@ -178940,7 +179130,7 @@ var pbkdf2Async = promisify(pbkdf2);
 
 // utils/browser.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var CHROME_PATHS = ["/usr/bin/google-chrome-stable"];
 var systemChromePath;
@@ -178949,7 +179139,7 @@ function findSystemChromePath() {
     return systemChromePath || void 0;
   }
   for (const p of CHROME_PATHS) {
-    if (existsSync6(p)) {
+    if (existsSync7(p)) {
       systemChromePath = p;
       log2.info(`found system chrome: ${p}`);
       return p;
@@ -182620,7 +182810,7 @@ var describeExpressionOptions = {
 };
 var expressBranches = (expressions) => describeBranches(expressions, describeExpressionOptions);
 var describeBranches = (descriptions, opts) => {
-  const delimiter2 = opts?.delimiter ?? ", ";
+  const delimiter3 = opts?.delimiter ?? ", ";
   const finalDelimiter = opts?.finalDelimiter ?? " or ";
   if (descriptions.length === 0)
     return "never";
@@ -182631,7 +182821,7 @@ var describeBranches = (descriptions, opts) => {
   const seen = {};
   const unique = descriptions.filter((s) => seen[s] ? false : seen[s] = true);
   const last = unique.pop();
-  return `${unique.join(delimiter2)}${unique.length ? finalDelimiter : ""}${last}`;
+  return `${unique.join(delimiter3)}${unique.length ? finalDelimiter : ""}${last}`;
 };
 var intersectBranches = (l2, r2, ctx) => {
   const batchesByR = r2.map(() => []);
@@ -193349,7 +193539,7 @@ function isValidUnquotedKey(key) {
 function isIdentifierSegment(key) {
   return /^[A-Z_]\w*$/i.test(key);
 }
-function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
+function isSafeUnquoted(value2, delimiter3 = DEFAULT_DELIMITER) {
   if (!value2) return false;
   if (value2 !== value2.trim()) return false;
   if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
@@ -193357,7 +193547,7 @@ function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
   if (value2.includes('"') || value2.includes("\\")) return false;
   if (/[[\]{}]/.test(value2)) return false;
   if (/[\n\r\t]/.test(value2)) return false;
-  if (value2.includes(delimiter2)) return false;
+  if (value2.includes(delimiter3)) return false;
   if (value2.startsWith(LIST_ITEM_MARKER)) return false;
   return true;
 }
@@ -193408,33 +193598,33 @@ function collectSingleKeyChain(startKey, startValue, maxDepth) {
 function buildFoldedKey(segments) {
   return segments.join(DOT);
 }
-function encodePrimitive(value2, delimiter2) {
+function encodePrimitive(value2, delimiter3) {
   if (value2 === null) return NULL_LITERAL;
   if (typeof value2 === "boolean") return String(value2);
   if (typeof value2 === "number") return String(value2);
-  return encodeStringLiteral(value2, delimiter2);
+  return encodeStringLiteral(value2, delimiter3);
 }
-function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (isSafeUnquoted(value2, delimiter2)) return value2;
+function encodeStringLiteral(value2, delimiter3 = DEFAULT_DELIMITER) {
+  if (isSafeUnquoted(value2, delimiter3)) return value2;
   return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
 }
 function encodeKey(key) {
   if (isValidUnquotedKey(key)) return key;
   return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
 }
-function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
-  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
+function encodeAndJoinPrimitives(values, delimiter3 = DEFAULT_DELIMITER) {
+  return values.map((v) => encodePrimitive(v, delimiter3)).join(delimiter3);
 }
 function formatHeader(length, options) {
   const key = options?.key;
   const fields = options?.fields;
-  const delimiter2 = options?.delimiter ?? COMMA2;
+  const delimiter3 = options?.delimiter ?? COMMA2;
   let header = "";
   if (key) header += encodeKey(key);
-  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
+  header += `[${length}${delimiter3 !== DEFAULT_DELIMITER ? delimiter3 : ""}]`;
   if (fields) {
     const quotedFields = fields.map((f) => encodeKey(f));
-    header += `{${quotedFields.join(delimiter2)}}`;
+    header += `{${quotedFields.join(delimiter3)}}`;
   }
   header += ":";
   return header;
@@ -193527,12 +193717,12 @@ function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
     yield indentedListItem(depth + 1, arrayLine, options.indent);
   }
 }
-function encodeInlineArrayLine(values, delimiter2, prefix) {
+function encodeInlineArrayLine(values, delimiter3, prefix) {
   const header = formatHeader(values.length, {
     key: prefix,
-    delimiter: delimiter2
+    delimiter: delimiter3
   });
-  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
+  const joinedValue = encodeAndJoinPrimitives(values, delimiter3);
   if (values.length === 0) return header;
   return `${header} ${joinedValue}`;
 }
@@ -196951,14 +197141,14 @@ function ReopenCurrentTool(ctx) {
 import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { join as join19 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join18 } from "node:path";
+import { delimiter as delimiter2, join as join18 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -196997,7 +197187,7 @@ function parseDevEnginesField(field) {
 }
 async function resolvePackageManagerSpec(cwd) {
   const pkgPath = join18(cwd, "package.json");
-  if (!existsSync7(pkgPath)) return null;
+  if (!existsSync8(pkgPath)) return null;
   let pkg;
   try {
     pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
@@ -197085,7 +197275,7 @@ async function ensurePackageManager(params) {
     );
     return false;
   }
-  process.env.PATH = `${params.binDir}${delimiter}${process.env.PATH ?? ""}`;
+  process.env.PATH = `${params.binDir}${delimiter2}${process.env.PATH ?? ""}`;
   const prepare = await runCorepack(["prepare", `${spec.name}@${spec.version}`, "--activate"]);
   if (prepare.exitCode !== 0) {
     log2.warning(
@@ -197152,7 +197342,7 @@ var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
     const packageJsonPath = join19(process.cwd(), "package.json");
-    return existsSync8(packageJsonPath);
+    return existsSync9(packageJsonPath);
   },
   run: async (options) => {
     const declared = await resolvePackageManagerSpec(process.cwd());
@@ -197246,14 +197436,14 @@ ${errorMessage}`]
 };
 
 // prep/installPythonDependencies.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6 } from "node:fs";
 import { join as join20 } from "node:path";
 function declaresBuildSystem(path4) {
   return /^\s*\[\s*build-system\s*\]/m.test(readFileSync6(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
   const path4 = join20(cwd, config3.file);
-  return existsSync9(path4) && (config3.applies?.(path4) ?? true);
+  return existsSync10(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
   {
@@ -200121,7 +200311,7 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isKimiPlanTierError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
   return (
@@ -200142,6 +200332,9 @@ function isMalformedKeyError(text) {
 function isClaudeSubscriptionDisabledError(text) {
   return /disabled Claude subscription access/i.test(text);
 }
+function isKimiPlanTierError(text) {
+  return /Your current (?:subscription does not have access to|plan supports only)\b/i.test(text);
+}
 var CLAUDE_SESSION_LIMIT_PATTERN = /hit your (?:session|weekly|five-hour|Opus|Sonnet|Haiku)\s+limit(?:\s*·\s*resets\s+([^"\n]+))?/i;
 function isClaudeSessionLimitError(text) {
   return CLAUDE_SESSION_LIMIT_PATTERN.test(text);
@@ -200215,6 +200408,13 @@ function formatApiKeyErrorSummary(params) {
       `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
+  if (isKimiPlanTierError(params.raw)) {
+    return [
+      "**Your Kimi membership doesn't include the model this run asked for.** Kimi K3 needs a Moderato plan or above, and K3's 1M context and Kimi K2 HighSpeed need Allegretto or above. Upgrade the membership, or switch this repo to **Kimi K2**, which every tier includes.",
+      "",
+      `[Kimi plans \u2192](https://www.kimi.com/membership/pricing) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/kimi-code) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
       `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\` / \`pullfrog auth grok\`), then re-trigger the run.`,
@@ -203860,7 +204060,7 @@ ${instructions.user}` : null,
         });
         if (agentId === "opencode") {
           const pluginDir = join28(process.cwd(), ".opencode", "plugin");
-          const hasPlugins = existsSync10(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+          const hasPlugins = existsSync11(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log2.info(
               "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -204597,7 +204797,7 @@ function resolveTarget(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.66");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.67");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -204764,7 +204964,7 @@ async function runCli5(input2) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.66";
+var VERSION10 = "0.1.67";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -108042,6 +108042,69 @@ var providers = {
       }
     }
   }),
+  // the same models as `moonshotai` above, billed against a Kimi membership
+  // instead of a Moonshot API balance — a separate endpoint, separate model
+  // ids and a separate key, which is why it is a provider rather than a second
+  // `envVars` entry. no provider injection is needed: models.dev carries
+  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
+  // ids list in `opencode models` and a run reaches Kimi's own auth check.
+  //
+  // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
+  // membership, so a Router path here would silently bill the wallet for
+  // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
+  // absence is load-bearing: `isCardGatedModel` reads it as "not Router-
+  // resolvable", `decideModelAccess` answers an explicit pick with the
+  // `router` copy ("add your own provider key"), and run-context clamps a
+  // keyless Router pick to the default subsidy model with `noRouterPath`.
+  "kimi-for-coding": provider({
+    // "Kimi Code" is the product name on kimi.com/code and in the console the
+    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
+    // is models.dev's id, so it is what `enabled_providers` and every
+    // `resolve` prefix must spell.
+    displayName: "Kimi Code",
+    envVars: ["KIMI_API_KEY"],
+    models: {
+      // the tier each model needs is in `description` because Kimi answers an
+      // out-of-tier request with 401 — indistinguishable from a bad key by
+      // status alone, and only `isKimiPlanTierError` tells them apart after the
+      // fact. saying it in the picker is the half that stops the run happening.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
+        resolve: "kimi-for-coding/k3",
+        effort: ["low", "high", "max"],
+        subagentModel: "kimi-k2"
+      },
+      // `preferred` sits on the 256K variant rather than the 1M flagship, which
+      // inverts the usual "top tier wins" rule for a reason specific to Kimi:
+      // below Allegretto the two are the SAME 256K ceiling and `k3` charges
+      // roughly double the quota for it, so on the median tier the flagship is
+      // strictly dominated rather than merely pricier. This flag seeds the
+      // onboarding pick (`getRecommendedSlug`) and wins key-only auto-select
+      // (`autoSelectModel`), which are exactly the two moments nobody has
+      // chosen yet.
+      "kimi-k3-256k": {
+        displayName: "Kimi K3 256K",
+        description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
+        resolve: "kimi-for-coding/k3-256k",
+        effort: ["low", "high", "max"],
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
+      "kimi-k2": {
+        displayName: "Kimi K2",
+        description: "Included in every Kimi membership tier",
+        resolve: "kimi-for-coding/kimi-for-coding"
+      },
+      "kimi-k2-highspeed": {
+        displayName: "Kimi K2 HighSpeed",
+        description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
+        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+      }
+    }
+  }),
   opencode: provider({
     displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
@@ -108594,6 +108657,80 @@ var providers = {
         openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
+  }),
+  vercel: provider({
+    // Vercel AI Gateway — one key serves every model it fronts. model IDs use
+    // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
+    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
+    // catalog's entries, not the upstream vendor's. deliberately no
+    // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
+    // over the Router proxy would bill the wallet for traffic the user pointed
+    // at their own gateway.
+    displayName: "Vercel AI Gateway",
+    envVars: ["AI_GATEWAY_API_KEY"],
+    models: {
+      "claude-opus": {
+        displayName: "Claude Opus",
+        resolve: "vercel/anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        preferred: true,
+        subagentModel: "claude-sonnet"
+      },
+      "claude-sonnet": {
+        displayName: "Claude Sonnet",
+        resolve: "vercel/anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh"]
+      },
+      "claude-haiku": {
+        displayName: "Claude Haiku",
+        resolve: "vercel/anthropic/claude-haiku-4.5"
+      },
+      "gpt-sol": {
+        displayName: "GPT Sol",
+        resolve: "vercel/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        subagentModel: "gpt-terra"
+      },
+      "gpt-terra": {
+        displayName: "GPT Terra",
+        resolve: "vercel/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "vercel/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gemini-pro": {
+        displayName: "Gemini Pro",
+        resolve: "vercel/google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"]
+      },
+      "gemini-flash": {
+        displayName: "Gemini Flash",
+        resolve: "vercel/google/gemini-3.6-flash",
+        effort: ["minimal", "low", "medium", "high"]
+      },
+      "deepseek-pro": {
+        displayName: "DeepSeek Pro",
+        resolve: "vercel/deepseek/deepseek-v4-pro-0813",
+        effort: ["high", "xhigh"]
+      },
+      "deepseek-flash": {
+        displayName: "DeepSeek Flash",
+        resolve: "vercel/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"]
+      },
+      glm: {
+        displayName: "GLM",
+        resolve: "vercel/zai/glm-5.3",
+        effort: ["low", "high", "max"]
+      },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "vercel/moonshotai/kimi-k3"
+      }
+    }
   })
 };
 function parseModel(slug2) {
@@ -109552,7 +109689,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.66",
+  version: "0.1.67",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -197757,7 +197894,7 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isKimiPlanTierError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
   return (
@@ -197778,6 +197915,9 @@ function isMalformedKeyError(text) {
 function isClaudeSubscriptionDisabledError(text) {
   return /disabled Claude subscription access/i.test(text);
 }
+function isKimiPlanTierError(text) {
+  return /Your current (?:subscription does not have access to|plan supports only)\b/i.test(text);
+}
 var CLAUDE_SESSION_LIMIT_PATTERN = /hit your (?:session|weekly|five-hour|Opus|Sonnet|Haiku)\s+limit(?:\s*·\s*resets\s+([^"\n]+))?/i;
 function isClaudeSessionLimitError(text) {
   return CLAUDE_SESSION_LIMIT_PATTERN.test(text);
@@ -197851,6 +197991,13 @@ function formatApiKeyErrorSummary(params) {
       `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
+  if (isKimiPlanTierError(params.raw)) {
+    return [
+      "**Your Kimi membership doesn't include the model this run asked for.** Kimi K3 needs a Moderato plan or above, and K3's 1M context and Kimi K2 HighSpeed need Allegretto or above. Upgrade the membership, or switch this repo to **Kimi K2**, which every tier includes.",
+      "",
+      `[Kimi plans \u2192](https://www.kimi.com/membership/pricing) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/kimi-code) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
       `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\` / \`pullfrog auth grok\`), then re-trigger the run.`,

package/dist/internal.js

@@ -338,6 +338,69 @@ var providers = {
       }
     }
   }),
+  // the same models as `moonshotai` above, billed against a Kimi membership
+  // instead of a Moonshot API balance — a separate endpoint, separate model
+  // ids and a separate key, which is why it is a provider rather than a second
+  // `envVars` entry. no provider injection is needed: models.dev carries
+  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
+  // ids list in `opencode models` and a run reaches Kimi's own auth check.
+  //
+  // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
+  // membership, so a Router path here would silently bill the wallet for
+  // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
+  // absence is load-bearing: `isCardGatedModel` reads it as "not Router-
+  // resolvable", `decideModelAccess` answers an explicit pick with the
+  // `router` copy ("add your own provider key"), and run-context clamps a
+  // keyless Router pick to the default subsidy model with `noRouterPath`.
+  "kimi-for-coding": provider({
+    // "Kimi Code" is the product name on kimi.com/code and in the console the
+    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
+    // is models.dev's id, so it is what `enabled_providers` and every
+    // `resolve` prefix must spell.
+    displayName: "Kimi Code",
+    envVars: ["KIMI_API_KEY"],
+    models: {
+      // the tier each model needs is in `description` because Kimi answers an
+      // out-of-tier request with 401 — indistinguishable from a bad key by
+      // status alone, and only `isKimiPlanTierError` tells them apart after the
+      // fact. saying it in the picker is the half that stops the run happening.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
+        resolve: "kimi-for-coding/k3",
+        effort: ["low", "high", "max"],
+        subagentModel: "kimi-k2"
+      },
+      // `preferred` sits on the 256K variant rather than the 1M flagship, which
+      // inverts the usual "top tier wins" rule for a reason specific to Kimi:
+      // below Allegretto the two are the SAME 256K ceiling and `k3` charges
+      // roughly double the quota for it, so on the median tier the flagship is
+      // strictly dominated rather than merely pricier. This flag seeds the
+      // onboarding pick (`getRecommendedSlug`) and wins key-only auto-select
+      // (`autoSelectModel`), which are exactly the two moments nobody has
+      // chosen yet.
+      "kimi-k3-256k": {
+        displayName: "Kimi K3 256K",
+        description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
+        resolve: "kimi-for-coding/k3-256k",
+        effort: ["low", "high", "max"],
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
+      "kimi-k2": {
+        displayName: "Kimi K2",
+        description: "Included in every Kimi membership tier",
+        resolve: "kimi-for-coding/kimi-for-coding"
+      },
+      "kimi-k2-highspeed": {
+        displayName: "Kimi K2 HighSpeed",
+        description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
+        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+      }
+    }
+  }),
   opencode: provider({
     displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
@@ -890,6 +953,80 @@ var providers = {
         openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
+  }),
+  vercel: provider({
+    // Vercel AI Gateway — one key serves every model it fronts. model IDs use
+    // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
+    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
+    // catalog's entries, not the upstream vendor's. deliberately no
+    // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
+    // over the Router proxy would bill the wallet for traffic the user pointed
+    // at their own gateway.
+    displayName: "Vercel AI Gateway",
+    envVars: ["AI_GATEWAY_API_KEY"],
+    models: {
+      "claude-opus": {
+        displayName: "Claude Opus",
+        resolve: "vercel/anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        preferred: true,
+        subagentModel: "claude-sonnet"
+      },
+      "claude-sonnet": {
+        displayName: "Claude Sonnet",
+        resolve: "vercel/anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh"]
+      },
+      "claude-haiku": {
+        displayName: "Claude Haiku",
+        resolve: "vercel/anthropic/claude-haiku-4.5"
+      },
+      "gpt-sol": {
+        displayName: "GPT Sol",
+        resolve: "vercel/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        subagentModel: "gpt-terra"
+      },
+      "gpt-terra": {
+        displayName: "GPT Terra",
+        resolve: "vercel/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "vercel/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gemini-pro": {
+        displayName: "Gemini Pro",
+        resolve: "vercel/google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"]
+      },
+      "gemini-flash": {
+        displayName: "Gemini Flash",
+        resolve: "vercel/google/gemini-3.6-flash",
+        effort: ["minimal", "low", "medium", "high"]
+      },
+      "deepseek-pro": {
+        displayName: "DeepSeek Pro",
+        resolve: "vercel/deepseek/deepseek-v4-pro-0813",
+        effort: ["high", "xhigh"]
+      },
+      "deepseek-flash": {
+        displayName: "DeepSeek Flash",
+        resolve: "vercel/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"]
+      },
+      glm: {
+        displayName: "GLM",
+        resolve: "vercel/zai/glm-5.3",
+        effort: ["low", "high", "max"]
+      },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "vercel/moonshotai/kimi-k3"
+      }
+    }
   })
 };
 function parseModel(slug) {

package/dist/models.d.ts

@@ -120,6 +120,7 @@ export declare const providers: {
     xai: ProviderConfig;
     deepseek: ProviderConfig;
     moonshotai: ProviderConfig;
+    "kimi-for-coding": ProviderConfig;
     opencode: ProviderConfig;
     "opencode-go": ProviderConfig;
     bedrock: ProviderConfig;
@@ -127,6 +128,7 @@ export declare const providers: {
     azure: ProviderConfig;
     "openai-compatible": ProviderConfig;
     openrouter: ProviderConfig;
+    vercel: ProviderConfig;
 };
 export type ModelProvider = keyof typeof providers;
 export declare function parseModel(slug: string): {

package/dist/utils/apiKeys.d.ts

@@ -135,6 +135,21 @@ export declare function isMalformedKeyError(text: string): boolean;
  * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
  */
 export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
+/**
+ * Kimi Code entitlement denial — the key is valid and the membership is live,
+ * but the tier doesn't include the model or the context window the run asked
+ * for (`k3` and `k3-256k` need Moderato, `kimi-for-coding-highspeed` and K3's
+ * 1M window need Allegretto). Kimi answers all of them with **401**, the same
+ * status as a revoked key, so nothing but the sentence tells them apart — and
+ * without that the run renders "rotate the key in your provider dashboard",
+ * which names three things that will not fix it.
+ *
+ * Both published shapes, parameterised over the clause that varies rather than
+ * the model id inside it, per `isOAuthCredentialExpiredError`. Listed in
+ * `isApiKeyAuthError` below so the branch is reachable whatever `type` Kimi
+ * puts in the payload. See wiki/kimi-code.md.
+ */
+export declare function isKimiPlanTierError(text: string): boolean;
 export declare function isClaudeSessionLimitError(text: string): boolean;
 /**
  * The provider rejected a credential we checked before the agent started, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",