pullfrog 0.1.66 → 0.1.68

package/dist/cli.mjs

@@ -525,15 +525,15 @@ var require_file_command = __commonJS({
     }
     exports.issueFileCommand = issueFileCommand;
     function prepareKeyValueMessage(key, value2) {
-      const delimiter2 = `ghadelimiter_${crypto5.randomUUID()}`;
+      const delimiter3 = `ghadelimiter_${crypto5.randomUUID()}`;
       const convertedValue = (0, utils_1.toCommandValue)(value2);
-      if (key.includes(delimiter2)) {
-        throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter2}"`);
+      if (key.includes(delimiter3)) {
+        throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter3}"`);
       }
-      if (convertedValue.includes(delimiter2)) {
-        throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter2}"`);
+      if (convertedValue.includes(delimiter3)) {
+        throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter3}"`);
       }
-      return `${key}<<${delimiter2}${os2.EOL}${convertedValue}${os2.EOL}${delimiter2}`;
+      return `${key}<<${delimiter3}${os2.EOL}${convertedValue}${os2.EOL}${delimiter3}`;
     }
     exports.prepareKeyValueMessage = prepareKeyValueMessage;
   }
@@ -11973,10 +11973,10 @@ var require_headers = __commonJS({
         const lowercaseName = name.toLowerCase();
         const exists = this[kHeadersMap].get(lowercaseName);
         if (exists) {
-          const delimiter2 = lowercaseName === "cookie" ? "; " : ", ";
+          const delimiter3 = lowercaseName === "cookie" ? "; " : ", ";
           this[kHeadersMap].set(lowercaseName, {
             name: exists.name,
-            value: `${exists.value}${delimiter2}${value2}`
+            value: `${exists.value}${delimiter3}${value2}`
           });
         } else {
           this[kHeadersMap].set(lowercaseName, { name, value: value2 });
@@ -46981,10 +46981,10 @@ var require_headers2 = __commonJS({
         const lowercaseName = isLowerCase ? name : name.toLowerCase();
         const exists = this.headersMap.get(lowercaseName);
         if (exists) {
-          const delimiter2 = lowercaseName === "cookie" ? "; " : ", ";
+          const delimiter3 = lowercaseName === "cookie" ? "; " : ", ";
           this.headersMap.set(lowercaseName, {
             name: exists.name,
-            value: `${exists.value}${delimiter2}${value2}`
+            value: `${exists.value}${delimiter3}${value2}`
           });
         } else {
           this.headersMap.set(lowercaseName, { name, value: value2 });
@@ -59293,8 +59293,8 @@ var init_regexes = __esm({
     _emoji = `^[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
     ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    mac = (delimiter2) => {
-      const escapedDelim = escapeRegex(delimiter2 ?? ":");
+    mac = (delimiter3) => {
+      const escapedDelim = escapeRegex(delimiter3 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -102436,10 +102436,10 @@ var require_turndown_cjs = __commonJS({
         if (!content) return "";
         content = content.replace(/\r?\n|\r/g, " ");
         var extraSpace = /^`|^ .*?[^ ].* $|`$/.test(content) ? " " : "";
-        var delimiter2 = "`";
+        var delimiter3 = "`";
         var matches = content.match(/`+/gm) || [];
-        while (matches.indexOf(delimiter2) !== -1) delimiter2 = delimiter2 + "`";
-        return delimiter2 + extraSpace + content + extraSpace + delimiter2;
+        while (matches.indexOf(delimiter3) !== -1) delimiter3 = delimiter3 + "`";
+        return delimiter3 + extraSpace + content + extraSpace + delimiter3;
       }
     };
     rules.image = {
@@ -104189,8 +104189,8 @@ var require_common = __commonJS({
         }
         return debug4;
       }
-      function extend3(namespace, delimiter2) {
-        const newDebug = createDebug(this.namespace + (typeof delimiter2 === "undefined" ? ":" : delimiter2) + namespace);
+      function extend3(namespace, delimiter3) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter3 === "undefined" ? ":" : delimiter3) + namespace);
         newDebug.log = this.log;
         return newDebug;
       }
@@ -108809,9 +108809,9 @@ var import_picocolors2 = __toESM(require_picocolors(), 1);
 
 // utils/codexAuth.ts
 import { spawn } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 
 // utils/oauthShared.ts
 var OAuthInvalidGrantError = class extends Error {
@@ -108960,11 +108960,60 @@ async function mintCodexAuth(options) {
   }
 }
 var SIGTERM_GRACE_MS = 5e3;
+var DEVICE_AUTH_ARGS = ["login", "--device-auth"];
+var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+function envValue(env2, name) {
+  if (env2[name] !== void 0) return env2[name];
+  const key = Object.keys(env2).find((candidate) => candidate.toUpperCase() === name.toUpperCase());
+  return key === void 0 ? void 0 : env2[key];
+}
+function commandProcessor(env2) {
+  return envValue(env2, "ComSpec") ?? join(envValue(env2, "SystemRoot") ?? "C:\\Windows", "system32", "cmd.exe");
+}
+function resolveSpawnTarget(params) {
+  if (process.platform !== "win32") {
+    return { file: params.command, args: params.args, wrapped: false };
+  }
+  const extensions2 = (envValue(params.env, "PATHEXT") ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
+  for (const directory of (envValue(params.env, "PATH") ?? "").split(delimiter).filter(Boolean)) {
+    for (const extension of extensions2) {
+      const candidate = join(directory, `${params.command}${extension.toLowerCase()}`);
+      if (!existsSync(candidate)) continue;
+      if (!/\.(cmd|bat)$/i.test(candidate)) {
+        return { file: candidate, args: params.args, wrapped: false };
+      }
+      const command = [`"${candidate}"`, ...params.args].join(" ");
+      return {
+        file: commandProcessor(params.env),
+        args: ["/d", "/s", "/c", `"${command}"`],
+        wrapped: true
+      };
+    }
+  }
+  return null;
+}
+function codexNotFoundMessage(env2) {
+  const install = "install it with `npm i -g @openai/codex` or see https://developers.openai.com/codex/cli for other install options.";
+  if (process.platform !== "win32") return `codex CLI not found on PATH. ${install}`;
+  const extensions2 = (envValue(env2, "PATHEXT") ?? DEFAULT_PATHEXT).split(";").filter(Boolean).join(" ");
+  return `codex CLI not found on PATH (searched every PATH entry for codex with ${extensions2}). a working \`codex --version\` in a shell does not prove Node can spawn it. ${install}`;
+}
 function runDeviceAuth(input2) {
   return new Promise((resolve3, reject) => {
-    const child = spawn("codex", ["login", "--device-auth"], {
+    const target = resolveSpawnTarget({
+      command: "codex",
+      args: DEVICE_AUTH_ARGS,
+      env: process.env
+    });
+    if (!target) {
+      reject(new Error(codexNotFoundMessage(process.env)));
+      return;
+    }
+    const child = spawn(target.file, target.args, {
       env: { ...process.env, CODEX_HOME: input2.codexHome },
-      stdio: ["ignore", input2.childStdio, input2.childStdio]
+      stdio: ["ignore", input2.childStdio, input2.childStdio],
+      windowsVerbatimArguments: target.wrapped,
+      windowsHide: true
     });
     if (input2.childStdio === "pipe") {
       const onLine = input2.onChildLine ?? (() => {
@@ -108976,6 +109025,10 @@ function runDeviceAuth(input2) {
     let timedOut = false;
     const timeoutTimer = setTimeout(() => {
       timedOut = true;
+      if (target.wrapped && child.pid) {
+        spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
+        return;
+      }
       child.kill("SIGTERM");
       killTimer = setTimeout(() => child.kill("SIGKILL"), SIGTERM_GRACE_MS);
     }, input2.timeoutMs);
@@ -108983,7 +109036,7 @@ function runDeviceAuth(input2) {
       clearTimeout(timeoutTimer);
       if (killTimer) clearTimeout(killTimer);
       const errno = err;
-      const message = errno.code === "ENOENT" ? "codex CLI not found on PATH. install it with `npm i -g @openai/codex` or see https://developers.openai.com/codex/cli for other install options." : `failed to spawn codex: ${errno.message}`;
+      const message = errno.code === "ENOENT" ? codexNotFoundMessage(process.env) : `failed to spawn codex: ${errno.message}`;
       reject(new Error(message));
     });
     child.on("close", (code, signal) => {
@@ -109797,7 +109850,7 @@ var import_arg2 = __toESM(require_arg(), 1);
 import { dirname as dirname6 } from "node:path";
 
 // main.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join28 } from "node:path";
 
@@ -110155,6 +110208,7 @@ import { performance as performance5 } from "node:perf_hooks";
 
 // effort.ts
 var DEFAULT_EFFORT_POSITION = 0.5;
+var SUBSIDY_RUNG = "high";
 var EFFORT_ALIASES = {
   low: 0,
   medium: 0.25,
@@ -110479,6 +110533,69 @@ var providers = {
       }
     }
   }),
+  // the same models as `moonshotai` above, billed against a Kimi membership
+  // instead of a Moonshot API balance — a separate endpoint, separate model
+  // ids and a separate key, which is why it is a provider rather than a second
+  // `envVars` entry. no provider injection is needed: models.dev carries
+  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
+  // ids list in `opencode models` and a run reaches Kimi's own auth check.
+  //
+  // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
+  // membership, so a Router path here would silently bill the wallet for
+  // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
+  // absence is load-bearing: `isCardGatedModel` reads it as "not Router-
+  // resolvable", `decideModelAccess` answers an explicit pick with the
+  // `router` copy ("add your own provider key"), and run-context clamps a
+  // keyless Router pick to the default subsidy model with `noRouterPath`.
+  "kimi-for-coding": provider({
+    // "Kimi Code" is the product name on kimi.com/code and in the console the
+    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
+    // is models.dev's id, so it is what `enabled_providers` and every
+    // `resolve` prefix must spell.
+    displayName: "Kimi Code",
+    envVars: ["KIMI_API_KEY"],
+    models: {
+      // the tier each model needs is in `description` because Kimi answers an
+      // out-of-tier request with 401 — indistinguishable from a bad key by
+      // status alone, and only `isKimiPlanTierError` tells them apart after the
+      // fact. saying it in the picker is the half that stops the run happening.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
+        resolve: "kimi-for-coding/k3",
+        effort: ["low", "high", "max"],
+        subagentModel: "kimi-k2"
+      },
+      // `preferred` sits on the 256K variant rather than the 1M flagship, which
+      // inverts the usual "top tier wins" rule for a reason specific to Kimi:
+      // below Allegretto the two are the SAME 256K ceiling and `k3` charges
+      // roughly double the quota for it, so on the median tier the flagship is
+      // strictly dominated rather than merely pricier. This flag seeds the
+      // onboarding pick (`getRecommendedSlug`) and wins key-only auto-select
+      // (`autoSelectModel`), which are exactly the two moments nobody has
+      // chosen yet.
+      "kimi-k3-256k": {
+        displayName: "Kimi K3 256K",
+        description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
+        resolve: "kimi-for-coding/k3-256k",
+        effort: ["low", "high", "max"],
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
+      "kimi-k2": {
+        displayName: "Kimi K2",
+        description: "Included in every Kimi membership tier",
+        resolve: "kimi-for-coding/kimi-for-coding"
+      },
+      "kimi-k2-highspeed": {
+        displayName: "Kimi K2 HighSpeed",
+        description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
+        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+      }
+    }
+  }),
   opencode: provider({
     displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
@@ -110495,6 +110612,15 @@ var providers = {
         // the model does cost nothing.
         isFree: true
       },
+      // Zen meters Fable like any other model, so this route reaches it without
+      // the Anthropic access grant `anthropic/claude-fable` still needs.
+      "claude-fable": {
+        displayName: "Claude Fable",
+        resolve: "opencode/claude-fable-5-1",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        openRouterResolve: "openrouter/~anthropic/claude-fable-latest",
+        subagentModel: "claude-sonnet"
+      },
       "claude-opus": {
         displayName: "Claude Opus",
         resolve: "opencode/claude-opus-5",
@@ -110608,6 +110734,17 @@ var providers = {
         effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/google/gemini-3.6-flash"
       },
+      // Zen serves K3, but rule 7 can only move a mirror when its upstream moves,
+      // so the K3 generation could never reach this block by bumping `kimi-k2`.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "opencode/kimi-k3",
+        // Zen publishes a single rung for K3 where OpenRouter publishes three.
+        effort: ["max"],
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        subagentModel: "kimi-k2"
+      },
       "kimi-k2": {
         displayName: "Kimi K2",
         // k2.7-code is UNDEPLOYED on Zen — still listed in /zen/v1/models, but
@@ -110619,25 +110756,58 @@ var providers = {
         resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
+      // M3 is its own line beside M2, not a bump of it — same reason `kimi-k3`
+      // sits beside `kimi-k2` rather than replacing it.
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "opencode/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
+      },
       // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
       "minimax-m2.5": {
         displayName: "MiniMax M2",
         resolve: "opencode/minimax-m2.7",
         openRouterResolve: "openrouter/minimax/minimax-m2.7"
       },
+      // Z.ai and xAI reach Zen subscribers only here — before this, `opencode-go`
+      // was the catalog's only GLM route, and Grok had no Zen route at all.
+      glm: {
+        displayName: "GLM",
+        resolve: "opencode/glm-5.2",
+        effort: ["high", "max"],
+        openRouterEffort: ["high", "xhigh"],
+        openRouterResolve: "openrouter/z-ai/glm-5.2"
+      },
+      grok: {
+        displayName: "Grok",
+        resolve: "opencode/grok-4.6",
+        effort: ["low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/x-ai/grok-4.6"
+      },
       "gpt-5-nano": {
         displayName: "GPT Nano",
         resolve: "opencode/gpt-5-nano",
         effort: ["minimal", "low", "medium", "high"],
         openRouterResolve: "openrouter/openai/gpt-5-nano"
       },
+      // Zen's live free MiMo, and the second free row in a menu that big-pickle
+      // was alone in since `mimo-v2-pro-free` lost its model.
+      mimo: {
+        displayName: "MiMo",
+        resolve: "opencode/mimo-v2.5-free",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       "mimo-v2-pro-free": {
         displayName: "MiMo V2 Pro",
         resolve: "opencode/mimo-v2-pro-free",
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
         isFree: true,
-        fallback: "opencode/big-pickle"
+        // the model id Zen dropped; land a stored MiMo pick back on MiMo rather
+        // than on the unrelated model it had to settle for while none was live.
+        fallback: "opencode/mimo"
       },
       "minimax-m2.5-free": {
         displayName: "MiniMax M2",
@@ -110732,6 +110902,16 @@ var providers = {
         resolve: "opencode-go/qwen3.7-plus",
         openRouterResolve: "openrouter/qwen/qwen3.7-plus"
       },
+      // the cheap rung Alibaba added under Plus (0.15/0.47 against 0.5/3), and
+      // the only model either OpenCode plan has added since this block was written.
+      "qwen-flash": {
+        displayName: "Qwen Flash",
+        resolve: "opencode-go/qwen3.8-flash",
+        effort: ["low", "medium", "xhigh"],
+        // the Go route publishes rungs where OpenRouter publishes none.
+        openRouterEffort: [],
+        openRouterResolve: "openrouter/qwen/qwen3.8-flash"
+      },
       // MiniMax — parity with opencode/* and openrouter/*; the m2 slug pins the
       // line for DB stability while the resolve tracks the current m2.7.
       "minimax-m3": {
@@ -111031,6 +111211,80 @@ var providers = {
         openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
+  }),
+  vercel: provider({
+    // Vercel AI Gateway — one key serves every model it fronts. model IDs use
+    // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
+    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
+    // catalog's entries, not the upstream vendor's. deliberately no
+    // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
+    // over the Router proxy would bill the wallet for traffic the user pointed
+    // at their own gateway.
+    displayName: "Vercel AI Gateway",
+    envVars: ["AI_GATEWAY_API_KEY"],
+    models: {
+      "claude-opus": {
+        displayName: "Claude Opus",
+        resolve: "vercel/anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        preferred: true,
+        subagentModel: "claude-sonnet"
+      },
+      "claude-sonnet": {
+        displayName: "Claude Sonnet",
+        resolve: "vercel/anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh"]
+      },
+      "claude-haiku": {
+        displayName: "Claude Haiku",
+        resolve: "vercel/anthropic/claude-haiku-4.5"
+      },
+      "gpt-sol": {
+        displayName: "GPT Sol",
+        resolve: "vercel/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        subagentModel: "gpt-terra"
+      },
+      "gpt-terra": {
+        displayName: "GPT Terra",
+        resolve: "vercel/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "vercel/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gemini-pro": {
+        displayName: "Gemini Pro",
+        resolve: "vercel/google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"]
+      },
+      "gemini-flash": {
+        displayName: "Gemini Flash",
+        resolve: "vercel/google/gemini-3.6-flash",
+        effort: ["minimal", "low", "medium", "high"]
+      },
+      "deepseek-pro": {
+        displayName: "DeepSeek Pro",
+        resolve: "vercel/deepseek/deepseek-v4-pro-0813",
+        effort: ["high", "xhigh"]
+      },
+      "deepseek-flash": {
+        displayName: "DeepSeek Flash",
+        resolve: "vercel/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"]
+      },
+      glm: {
+        displayName: "GLM",
+        resolve: "vercel/zai/glm-5.3",
+        effort: ["low", "high", "max"]
+      },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "vercel/moonshotai/kimi-k3"
+      }
+    }
   })
 };
 function parseModel(slug2) {
@@ -111458,9 +111712,9 @@ function logTokenTable(t2) {
 }
 
 // utils/globals.ts
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 var isGitHubActions = !!process.env.GITHUB_ACTIONS;
-var isInsideDocker = existsSync("/.dockerenv");
+var isInsideDocker = existsSync2("/.dockerenv");
 
 // utils/log.ts
 var logContext = new AsyncLocalStorage();
@@ -111688,7 +111942,7 @@ function formatUsageSummary(entries) {
 
 // utils/install.ts
 import { spawnSync } from "node:child_process";
-import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync } from "node:fs";
+import { chmodSync, createWriteStream, existsSync as existsSync3, mkdirSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { pipeline } from "node:stream/promises";
 async function installFromNpmTarball(params) {
@@ -111697,7 +111951,7 @@ async function installFromNpmTarball(params) {
   const packageRoot = join2(tempDir, `npm-${params.packageName.replace(/[^a-z0-9]+/gi, "-")}`);
   const extractedDir = join2(packageRoot, "package");
   const cliPath = join2(extractedDir, params.executablePath);
-  if (existsSync2(cliPath)) {
+  if (existsSync3(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -111771,7 +112025,7 @@ async function installFromNpmTarball(params) {
     }
     log2.debug(`\xBB dependencies installed`);
   }
-  if (!existsSync2(cliPath)) {
+  if (!existsSync3(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   chmodSync(cliPath, 493);
@@ -111782,6 +112036,7 @@ async function installFromNpmTarball(params) {
 // utils/providerErrors.ts
 var PROVIDER_BILLING_EXHAUSTED_LABEL = "provider billing exhausted";
 var PROVIDER_NO_ENDPOINTS_LABEL = "provider no routable endpoints";
+var PROVIDER_USAGE_LIMIT_LABEL = "provider usage limit reached";
 var statusKey = `\\b(?:status[_ ]?code|http[_ ]?status|status)["']?\\s*[:=]\\s*["']?`;
 var ANTHROPIC_SPEND_CAP_PATTERN = /reached your specified API usage limits\.?(?:\s*You will regain access on ([^"\n]+?)\.)?/i;
 function findAnthropicSpendCap(text) {
@@ -111827,6 +112082,14 @@ var PROVIDER_ERROR_PATTERNS = [
   // the wallet-shaped patterns above reach, and its 400 sits nowhere near a
   // `status:` key either — so the whole message was dropped on the floor (#1208).
   { regex: ANTHROPIC_SPEND_CAP_PATTERN, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // OpenCode Zen / Codex-subscription cap: `AI_APICallError: The usage limit has
+  // been reached`. Its noun is "usage limit" with no "rate", no status code and
+  // no wallet wording, so every pattern here missed it and `lastProviderError`
+  // stayed unset — which suppresses nothing, so the run was reported as "The
+  // model produced no output at all … usually transient; re-running often
+  // succeeds" while the same log held nine of these. Measured on a live account
+  // whose ChatGPT subscription was capped.
+  { regex: /\bthe usage limit has been reached\b/i, label: PROVIDER_USAGE_LIMIT_LABEL },
   // the OpenRouter shapes `isRouterKeylimitExhaustedError` matches. on a Router
   // run those mean the PULLFROG wallet is empty and `renderRunError` returns a
   // `BillingError` before ever reaching this list; on a BYOK run the very same
@@ -111957,7 +112220,7 @@ function ossEffortFloor(ctx) {
   const alias = resolveRunAlias(ctx);
   const published = alias?.openRouterEffort ?? alias?.effort;
   if (!published) return 0;
-  return rungPosition({ rung: "high", published }) ?? 0;
+  return rungPosition({ rung: SUBSIDY_RUNG, published }) ?? 0;
 }
 function resolveRunEffort(ctx) {
   const configured = ctx.payload.effort !== void 0;
@@ -111978,7 +112241,7 @@ function resolveRunEffort(ctx) {
 
 // utils/skills.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -111989,7 +112252,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.66",
+  version: "0.1.68",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -112118,7 +112381,7 @@ function resolveSkillPath(name) {
     join3(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate)) return candidate;
+    if (existsSync4(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
@@ -114159,13 +114422,13 @@ var claude = agent({
 
 // agents/codex.ts
 var core2 = __toESM(require_core(), 1);
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 
 // utils/codexHome.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir2, userInfo } from "node:os";
 import { join as join6 } from "node:path";
 var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
@@ -114214,7 +114477,7 @@ function installCodexAuth() {
 }
 function writeOpenCodeAuthEntry(params) {
   let existing = {};
-  if (existsSync4(params.authPath)) {
+  if (existsSync5(params.authPath)) {
     try {
       const parsed2 = JSON.parse(readFileSync3(params.authPath, "utf8"));
       if (parsed2 && typeof parsed2 === "object") existing = parsed2;
@@ -114531,7 +114794,7 @@ var APPROVAL_MODE_KEY = "default_tools_approval_mode";
 var APPROVE_TOOLS = `${APPROVAL_MODE_KEY} = "approve"`;
 function repoMcpApprovals(repoDir) {
   const path4 = join7(repoDir, ".codex", "config.toml");
-  if (!existsSync5(path4)) return [];
+  if (!existsSync6(path4)) return [];
   const out = [];
   let section = [];
   let isServerTable = false;
@@ -178940,7 +179203,7 @@ var pbkdf2Async = promisify(pbkdf2);
 
 // utils/browser.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var CHROME_PATHS = ["/usr/bin/google-chrome-stable"];
 var systemChromePath;
@@ -178949,7 +179212,7 @@ function findSystemChromePath() {
     return systemChromePath || void 0;
   }
   for (const p of CHROME_PATHS) {
-    if (existsSync6(p)) {
+    if (existsSync7(p)) {
       systemChromePath = p;
       log2.info(`found system chrome: ${p}`);
       return p;
@@ -182620,7 +182883,7 @@ var describeExpressionOptions = {
 };
 var expressBranches = (expressions) => describeBranches(expressions, describeExpressionOptions);
 var describeBranches = (descriptions, opts) => {
-  const delimiter2 = opts?.delimiter ?? ", ";
+  const delimiter3 = opts?.delimiter ?? ", ";
   const finalDelimiter = opts?.finalDelimiter ?? " or ";
   if (descriptions.length === 0)
     return "never";
@@ -182631,7 +182894,7 @@ var describeBranches = (descriptions, opts) => {
   const seen = {};
   const unique = descriptions.filter((s) => seen[s] ? false : seen[s] = true);
   const last = unique.pop();
-  return `${unique.join(delimiter2)}${unique.length ? finalDelimiter : ""}${last}`;
+  return `${unique.join(delimiter3)}${unique.length ? finalDelimiter : ""}${last}`;
 };
 var intersectBranches = (l2, r2, ctx) => {
   const batchesByR = r2.map(() => []);
@@ -193349,7 +193612,7 @@ function isValidUnquotedKey(key) {
 function isIdentifierSegment(key) {
   return /^[A-Z_]\w*$/i.test(key);
 }
-function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
+function isSafeUnquoted(value2, delimiter3 = DEFAULT_DELIMITER) {
   if (!value2) return false;
   if (value2 !== value2.trim()) return false;
   if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
@@ -193357,7 +193620,7 @@ function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
   if (value2.includes('"') || value2.includes("\\")) return false;
   if (/[[\]{}]/.test(value2)) return false;
   if (/[\n\r\t]/.test(value2)) return false;
-  if (value2.includes(delimiter2)) return false;
+  if (value2.includes(delimiter3)) return false;
   if (value2.startsWith(LIST_ITEM_MARKER)) return false;
   return true;
 }
@@ -193408,33 +193671,33 @@ function collectSingleKeyChain(startKey, startValue, maxDepth) {
 function buildFoldedKey(segments) {
   return segments.join(DOT);
 }
-function encodePrimitive(value2, delimiter2) {
+function encodePrimitive(value2, delimiter3) {
   if (value2 === null) return NULL_LITERAL;
   if (typeof value2 === "boolean") return String(value2);
   if (typeof value2 === "number") return String(value2);
-  return encodeStringLiteral(value2, delimiter2);
+  return encodeStringLiteral(value2, delimiter3);
 }
-function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (isSafeUnquoted(value2, delimiter2)) return value2;
+function encodeStringLiteral(value2, delimiter3 = DEFAULT_DELIMITER) {
+  if (isSafeUnquoted(value2, delimiter3)) return value2;
   return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
 }
 function encodeKey(key) {
   if (isValidUnquotedKey(key)) return key;
   return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
 }
-function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
-  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
+function encodeAndJoinPrimitives(values, delimiter3 = DEFAULT_DELIMITER) {
+  return values.map((v) => encodePrimitive(v, delimiter3)).join(delimiter3);
 }
 function formatHeader(length, options) {
   const key = options?.key;
   const fields = options?.fields;
-  const delimiter2 = options?.delimiter ?? COMMA2;
+  const delimiter3 = options?.delimiter ?? COMMA2;
   let header = "";
   if (key) header += encodeKey(key);
-  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
+  header += `[${length}${delimiter3 !== DEFAULT_DELIMITER ? delimiter3 : ""}]`;
   if (fields) {
     const quotedFields = fields.map((f) => encodeKey(f));
-    header += `{${quotedFields.join(delimiter2)}}`;
+    header += `{${quotedFields.join(delimiter3)}}`;
   }
   header += ":";
   return header;
@@ -193527,12 +193790,12 @@ function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
     yield indentedListItem(depth + 1, arrayLine, options.indent);
   }
 }
-function encodeInlineArrayLine(values, delimiter2, prefix) {
+function encodeInlineArrayLine(values, delimiter3, prefix) {
   const header = formatHeader(values.length, {
     key: prefix,
-    delimiter: delimiter2
+    delimiter: delimiter3
   });
-  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
+  const joinedValue = encodeAndJoinPrimitives(values, delimiter3);
   if (values.length === 0) return header;
   return `${header} ${joinedValue}`;
 }
@@ -194600,6 +194863,9 @@ function formatModelLabel(params) {
   if (params.fallbackFrom) {
     return `${base} (credentials for ${providerDisplayName(params.fallbackFrom)} were rejected by the provider)`;
   }
+  if (params.clamped?.reason === "trial") {
+    return `${base} (free trial)`;
+  }
   if (params.clamped) {
     const target = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
     return params.clamped.reason === "card" ? `${base} (${target} needs a [card on file](https://docs.pullfrog.com/models))` : `${base} (${target} needs a [provider key](https://docs.pullfrog.com/models) \u2014 no Router support yet)`;
@@ -194609,6 +194875,15 @@ function formatModelLabel(params) {
   }
   return base;
 }
+function buildTrialDisclosure(owner) {
+  const consoleUrl2 = owner ? `https://pullfrog.com/console/${owner}` : "https://pullfrog.com/console";
+  return [
+    "---",
+    "",
+    "> [!IMPORTANT]",
+    `> **This run used the free trial model.** \`DeepSeek Flash\` is fast and cheap \u2014 expect lighter work than a frontier model. [Connect a subscription or API key \u2192](${consoleUrl2})`
+  ].join("\n");
+}
 function buildPullfrogFooter(params) {
   const parts = [];
   if (params.shaPinned) {
@@ -194641,10 +194916,13 @@ function buildPullfrogFooter(params) {
     );
   }
   const allParts = [...parts, "[\u{1D54F}](https://x.com/pullfrogai)"];
+  const disclosure = params.clamped?.reason === "trial" ? `${buildTrialDisclosure(params.owner)}
+
+` : "";
   return `
 
 ${PULLFROG_DIVIDER}
-<sup>${FROG_LOGO}&nbsp;&nbsp;\uFF5C ${allParts.join(" \uFF5C ")}</sup>`;
+${disclosure}<sup>${FROG_LOGO}&nbsp;&nbsp;\uFF5C ${allParts.join(" \uFF5C ")}</sup>`;
 }
 function stripExistingFooter(body) {
   const dividerIndex = body.indexOf(PULLFROG_DIVIDER);
@@ -194798,7 +195076,8 @@ function buildCommentFooter(ctx, customParts) {
     clamped: ctx.toolState.modelClamped,
     unselectedProxyDefault: ctx.toolState.unselectedProxyDefault,
     shaPinned: ctx.toolState.shaPinned,
-    oss: ctx.oss
+    oss: ctx.oss,
+    owner: ctx.repo.owner
   });
 }
 function buildImplementPlanLink(ctx, issueNumber, commentId) {
@@ -195797,7 +196076,8 @@ async function createAndSubmitWithFooter(ctx, params, opts) {
       clamped: ctx.toolState.modelClamped,
       unselectedProxyDefault: ctx.toolState.unselectedProxyDefault,
       shaPinned: ctx.toolState.shaPinned,
-      oss: ctx.oss
+      oss: ctx.oss,
+      owner: ctx.repo.owner
     });
     return await ctx.octokit.rest.pulls.submitReview({
       owner: params.owner,
@@ -196951,14 +197231,14 @@ function ReopenCurrentTool(ctx) {
 import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { join as join19 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join18 } from "node:path";
+import { delimiter as delimiter2, join as join18 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -196997,7 +197277,7 @@ function parseDevEnginesField(field) {
 }
 async function resolvePackageManagerSpec(cwd) {
   const pkgPath = join18(cwd, "package.json");
-  if (!existsSync7(pkgPath)) return null;
+  if (!existsSync8(pkgPath)) return null;
   let pkg;
   try {
     pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
@@ -197085,7 +197365,7 @@ async function ensurePackageManager(params) {
     );
     return false;
   }
-  process.env.PATH = `${params.binDir}${delimiter}${process.env.PATH ?? ""}`;
+  process.env.PATH = `${params.binDir}${delimiter2}${process.env.PATH ?? ""}`;
   const prepare = await runCorepack(["prepare", `${spec.name}@${spec.version}`, "--activate"]);
   if (prepare.exitCode !== 0) {
     log2.warning(
@@ -197152,7 +197432,7 @@ var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
     const packageJsonPath = join19(process.cwd(), "package.json");
-    return existsSync8(packageJsonPath);
+    return existsSync9(packageJsonPath);
   },
   run: async (options) => {
     const declared = await resolvePackageManagerSpec(process.cwd());
@@ -197246,14 +197526,14 @@ ${errorMessage}`]
 };
 
 // prep/installPythonDependencies.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6 } from "node:fs";
 import { join as join20 } from "node:path";
 function declaresBuildSystem(path4) {
   return /^\s*\[\s*build-system\s*\]/m.test(readFileSync6(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
   const path4 = join20(cwd, config3.file);
-  return existsSync9(path4) && (config3.applies?.(path4) ?? true);
+  return existsSync10(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
   {
@@ -198558,7 +198838,8 @@ function buildPrBodyWithFooter(ctx, body) {
     clamped: ctx.toolState.modelClamped,
     unselectedProxyDefault: ctx.toolState.unselectedProxyDefault,
     shaPinned: ctx.toolState.shaPinned,
-    oss: ctx.oss
+    oss: ctx.oss,
+    owner: ctx.repo.owner
   });
   const bodyWithoutFooter = stripExistingFooter(fixDoubleEscapedString(body));
   return `${bodyWithoutFooter}${footer}`;
@@ -199865,10 +200146,12 @@ function isByokSetupError(text) {
 var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
 var ROUTER_UNFUNDED_MARKER = "your Pullfrog Router balance is empty";
 var CREDENTIAL_REJECTED_MARKER = "was rejected by its provider";
-function buildKeyError(params) {
-  if (params.secretsUnavailable) return buildSecretsUnavailableError(params);
-  if (params.routerUnfunded) return buildRouterUnfundedError(params);
-  return buildMissingApiKeyError(params);
+var NoUsableCredentialError = class extends Error {
+};
+function throwKeyError(params) {
+  if (params.secretsUnavailable) throw new Error(buildSecretsUnavailableError(params));
+  if (params.routerUnfunded) throw new NoUsableCredentialError(buildRouterUnfundedError(params));
+  throw new NoUsableCredentialError(buildMissingApiKeyError(params));
 }
 function buildRouterUnfundedError(params) {
   const billingUrl = `${getApiUrl()}/console/${params.owner}#billing`;
@@ -200067,61 +200350,55 @@ function validateAgentApiKey(params) {
         validateVertexSetup({ owner: params.owner, name: params.name });
         return;
       }
-      validateBedrockSetup({ owner: params.owner, name: params.name });
-      return;
+      if (process.env[BEDROCK_MODEL_ID_ENV]?.trim() === params.model) {
+        validateBedrockSetup({ owner: params.owner, name: params.name });
+        return;
+      }
     }
     if (params.agent.name === "opencode") {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
       if (getModelEnvVars(params.model).some(hasEnvVar2)) return;
-      throw new Error(
-        buildKeyError({
-          owner: params.owner,
-          name: params.name,
-          model: params.model,
-          secretsUnavailable: params.secretsUnavailable,
-          routerUnfunded: params.routerUnfunded
-        })
-      );
-    }
-    if (hasSingleProviderAuth(params.agent.name)) return;
-    throw new Error(
-      buildKeyError({
+      throwKeyError({
         owner: params.owner,
         name: params.name,
         model: params.model,
         secretsUnavailable: params.secretsUnavailable,
         routerUnfunded: params.routerUnfunded
-      })
-    );
+      });
+    }
+    if (hasSingleProviderAuth(params.agent.name)) return;
+    throwKeyError({
+      owner: params.owner,
+      name: params.name,
+      model: params.model,
+      secretsUnavailable: params.secretsUnavailable,
+      routerUnfunded: params.routerUnfunded
+    });
   }
   if (params.agent.name === "opencode") {
     if ([...params.authorized].some(modelHasRuntimeAuth)) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
-    throw new Error(
-      buildKeyError({
-        owner: params.owner,
-        name: params.name,
-        secretsUnavailable: params.secretsUnavailable,
-        routerUnfunded: params.routerUnfunded
-      })
-    );
-  }
-  if (hasSingleProviderAuth(params.agent.name)) return;
-  throw new Error(
-    buildKeyError({
+    throwKeyError({
       owner: params.owner,
       name: params.name,
       secretsUnavailable: params.secretsUnavailable,
       routerUnfunded: params.routerUnfunded
-    })
-  );
+    });
+  }
+  if (hasSingleProviderAuth(params.agent.name)) return;
+  throwKeyError({
+    owner: params.owner,
+    name: params.name,
+    secretsUnavailable: params.secretsUnavailable,
+    routerUnfunded: params.routerUnfunded
+  });
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isKimiPlanTierError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
   return (
@@ -200142,6 +200419,9 @@ function isMalformedKeyError(text) {
 function isClaudeSubscriptionDisabledError(text) {
   return /disabled Claude subscription access/i.test(text);
 }
+function isKimiPlanTierError(text) {
+  return /Your current (?:subscription does not have access to|plan supports only)\b/i.test(text);
+}
 var CLAUDE_SESSION_LIMIT_PATTERN = /hit your (?:session|weekly|five-hour|Opus|Sonnet|Haiku)\s+limit(?:\s*·\s*resets\s+([^"\n]+))?/i;
 function isClaudeSessionLimitError(text) {
   return CLAUDE_SESSION_LIMIT_PATTERN.test(text);
@@ -200215,6 +200495,13 @@ function formatApiKeyErrorSummary(params) {
       `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
+  if (isKimiPlanTierError(params.raw)) {
+    return [
+      "**Your Kimi membership doesn't include the model this run asked for.** Kimi K3 needs a Moderato plan or above, and K3's 1M context and Kimi K2 HighSpeed need Allegretto or above. Upgrade the membership, or switch this repo to **Kimi K2**, which every tier includes.",
+      "",
+      `[Kimi plans \u2192](https://www.kimi.com/membership/pricing) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/kimi-code) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
       `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\` / \`pullfrog auth grok\`), then re-trigger the run.`,
@@ -200232,9 +200519,9 @@ function formatApiKeyErrorSummary(params) {
     ].join("\n");
   }
   return [
-    `**Your LLM provider API key was rejected.** Rotate the key in your provider dashboard, then update the matching GitHub Actions secret.`,
+    `**Your LLM provider API key was rejected.** Rotate the key in your provider dashboard, then update the copy Pullfrog uses \u2014 wherever you saved it.`,
     "",
-    `[Update repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    `[Pullfrog secrets \u2192](${getApiUrl()}/console/${params.owner}) \xB7 [Repo secrets \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
   ].join("\n");
 }
 
@@ -201460,6 +201747,9 @@ var DebugInput = type.enumerated("disabled", "enabled");
 var JsonPayload = type({
   "~pullfrog": "true",
   version: "string",
+  // the server's run type, forwarded verbatim to run-context. optional so a
+  // payload from an older server build still parses against a newer action.
+  "type?": "string | undefined",
   "model?": "string | undefined",
   "modelExplicit?": "boolean | undefined",
   "effort?": "number | string | undefined",
@@ -201945,7 +202235,8 @@ ${ctx.error}` : ctx.error;
     clamped: ctx.toolState.modelClamped,
     unselectedProxyDefault: ctx.toolState.unselectedProxyDefault,
     shaPinned: ctx.toolState.shaPinned,
-    oss: ctx.toolState.oss
+    oss: ctx.toolState.oss,
+    owner: repoContext.owner
   });
   const body = `${formattedError}${footer}`;
   const comment = ctx.toolState.progressComment;
@@ -202028,7 +202319,7 @@ async function mintProxyKey(ctx) {
   }
 }
 async function buildProxyTokenHeaders(ctx) {
-  const fundingSource = ctx.oss ? "oss" : "router";
+  const fundingSource = ctx.fundingSource;
   if (ctx.oidcCredentials) {
     const creds = ctx.oidcCredentials;
     const oidcToken = await op(() => fetchIdTokenFromStash(creds), {
@@ -202060,7 +202351,7 @@ async function resolveProxyModel(ctx) {
   const key = await mintProxyKey({
     oidcCredentials: ctx.oidcCredentials,
     repo: ctx.repo,
-    oss: ctx.oss
+    fundingSource: ctx.oss ? "oss" : "router"
   });
   if (!key) return;
   process.env.OPENROUTER_API_KEY = key;
@@ -202132,6 +202423,26 @@ async function runProxyResolution(ctx) {
     throw error62;
   }
 }
+async function resolveTrialFallback(ctx) {
+  if (process.env.PULLFROG_MODEL?.trim()) return false;
+  if (!ctx.oidcCredentials && !isLocalApiUrl()) return false;
+  const key = await mintProxyKey({
+    oidcCredentials: ctx.oidcCredentials,
+    repo: ctx.repo,
+    fundingSource: "trial"
+  });
+  if (!key) return false;
+  process.env.OPENROUTER_API_KEY = key;
+  core9.setSecret(key);
+  ctx.payload.proxyModel = DEFAULT_PROXY_MODEL;
+  ctx.toolState.model = DEFAULT_PROXY_MODEL;
+  ctx.toolState.modelClamped = {
+    from: ctx.configuredModel ?? DEFAULT_PROXY_MODEL,
+    reason: "trial"
+  };
+  log2.info(`\xBB proxy: trial \u2192 ${DEFAULT_PROXY_MODEL}`);
+  return true;
+}
 
 // utils/prSummary.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
@@ -202309,8 +202620,9 @@ async function fetchRunContext(params) {
     if (params.oidcToken) {
       headers["X-GitHub-OIDC-Token"] = params.oidcToken;
     }
+    const query = params.runType ? `?type=${encodeURIComponent(params.runType)}` : "";
     const response = await apiFetch({
-      path: `/api/repo/${params.repoContext.owner}/${params.repoContext.name}/run-context`,
+      path: `/api/repo/${params.repoContext.owner}/${params.repoContext.name}/run-context${query}`,
       headers,
       signal: controller.signal
     });
@@ -202347,7 +202659,8 @@ async function fetchRunContext(params) {
       proxyModel: data.proxyModel,
       dbSecrets: data.dbSecrets,
       secretsUnavailable: data.secretsUnavailable,
-      routerUnfunded: data.routerUnfunded
+      routerUnfunded: data.routerUnfunded,
+      trialFallback: data.trialFallback
     };
   } catch {
     clearTimeout(timeoutId);
@@ -202388,7 +202701,7 @@ async function resolveRunContextData(params) {
       retries: [100, 500],
       bail: (error62) => !isTransientOctokitError(error62)
     })(),
-    fetchRunContext({ token: params.token, repoContext, oidcToken })
+    fetchRunContext({ token: params.token, repoContext, oidcToken, runType: params.runType })
   ]);
   return {
     repo: {
@@ -202406,7 +202719,8 @@ async function resolveRunContextData(params) {
     // a failed mint on a runner that should have been able to mint is the same
     // outcome as the server-side failure: the run never sees stored secrets.
     secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0,
-    routerUnfunded: runContext.routerUnfunded
+    routerUnfunded: runContext.routerUnfunded,
+    trialFallback: runContext.trialFallback
   };
 }
 
@@ -203486,7 +203800,11 @@ async function main() {
     resolveGit();
     const jobToken = getJobToken();
     const initialOctokit = createOctokit(jobToken);
-    const runContext = await resolveRunContextData({ octokit: initialOctokit, token: jobToken });
+    const runContext = await resolveRunContextData({
+      octokit: initialOctokit,
+      token: jobToken,
+      runType: typeof resolvedPromptInput === "string" ? void 0 : resolvedPromptInput.type
+    });
     timer.checkpoint("runContextData");
     const payload = resolvePayload(resolvedPromptInput, runContext.repoSettings);
     const toolState = initToolState({
@@ -203667,7 +203985,7 @@ async function main() {
         }
         const resolvedModel = credentials.kind === "fellBack" ? credentials.replacement : configuredModel;
         vertexCredentials = materializeVertexCredentials({ model: resolvedModel });
-        const agent2 = resolveAgent({
+        let agent2 = resolveAgent({
           model: resolvedModel,
           proxyModel: payload.proxyModel,
           // the account opt-in and the canary arm are both admissions to codex, so
@@ -203679,15 +203997,32 @@ async function main() {
         const effectiveModel = payload.proxyModel ?? resolvedModel ?? payload.model;
         toolState.model = effectiveModel;
         if (!payload.proxyModel) {
-          validateAgentApiKey({
-            agent: agent2,
-            model: effectiveModel,
-            authorized: getAuthorizedModels(),
-            owner: runContext.repo.owner,
-            name: runContext.repo.name,
-            secretsUnavailable: runContext.secretsUnavailable,
-            routerUnfunded: runContext.routerUnfunded
-          });
+          try {
+            validateAgentApiKey({
+              agent: agent2,
+              model: effectiveModel,
+              authorized: getAuthorizedModels(),
+              owner: runContext.repo.owner,
+              name: runContext.repo.name,
+              secretsUnavailable: runContext.secretsUnavailable,
+              routerUnfunded: runContext.routerUnfunded
+            });
+          } catch (missingKey) {
+            const funded = runContext.trialFallback && missingKey instanceof NoUsableCredentialError ? await resolveTrialFallback({
+              payload,
+              configuredModel: effectiveModel,
+              oidcCredentials,
+              repo: runContext.repo,
+              toolState
+            }) : false;
+            if (!funded) throw missingKey;
+            agent2 = resolveAgent({
+              model: resolvedModel,
+              proxyModel: payload.proxyModel,
+              codexAgent: runContext.repoSettings.codexAgent || payload.codexArm === true
+            });
+            toolState.agent = agent2.name;
+          }
         }
         await setupGit({
           gitToken: tokenRef.gitToken,
@@ -203860,7 +204195,7 @@ ${instructions.user}` : null,
         });
         if (agentId === "opencode") {
           const pluginDir = join28(process.cwd(), ".opencode", "plugin");
-          const hasPlugins = existsSync10(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+          const hasPlugins = existsSync11(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log2.info(
               "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -204597,7 +204932,7 @@ function resolveTarget(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.66");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.68");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -204764,7 +205099,7 @@ async function runCli5(input2) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.66";
+var VERSION10 = "0.1.68";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);