pullfrog 0.1.79 → 0.1.81

package/dist/cli.mjs

@@ -108850,10 +108850,10 @@ function decodeJwtExpMs(token) {
 // utils/codexOAuth.ts
 var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
-function codexChainIsDead(body) {
+function codexChainIsDead(status, body) {
+  if (status !== 401) return false;
   const err = parseOAuthErrorBody(body)?.error;
-  if (!err || typeof err !== "object") return false;
-  return "code" in err && err.code === "token_expired";
+  return !(err && typeof err === "object" && "code" in err && err.code === "invalid_client");
 }
 async function refreshCodexAuthBody(body) {
   const response = await fetch(CODEX_OAUTH_TOKEN_URL, {
@@ -108869,7 +108869,12 @@ async function refreshCodexAuthBody(body) {
   if (!response.ok) {
     const text = await response.text().catch(() => "");
     if (response.status >= 400 && response.status < 500) {
-      throw new OAuthInvalidGrantError("Codex", response.status, text, codexChainIsDead(text));
+      throw new OAuthInvalidGrantError(
+        "Codex",
+        response.status,
+        text,
+        codexChainIsDead(response.status, text)
+      );
     }
     throw new Error(`Codex token refresh failed: ${response.status} ${text}`);
   }
@@ -123000,7 +123005,7 @@ var import_picocolors = __toESM(require_picocolors(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.79",
+  version: "0.1.81",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -123124,6 +123129,27 @@ var PULLFROG_API_URL = (process.env.PULLFROG_API_URL || "https://pullfrog.com").
   /\/+$/,
   ""
 );
+var CODEX_AUTH_SECRET = "CODEX_AUTH_JSON";
+var CLAUDE_OAUTH_SECRET = "CLAUDE_CODE_OAUTH_TOKEN";
+var GROK_AUTH_SECRET = "GROK_AUTH_JSON";
+var SUBSCRIPTION_SECRET_NAMES = [CODEX_AUTH_SECRET, CLAUDE_OAUTH_SECRET, GROK_AUTH_SECRET];
+function shadowRefusal(params) {
+  const repos = params.overrides.filter((override) => override.name === params.name).map((override) => `${params.owner}/${override.repo}`);
+  if (!repos.length) return null;
+  const bin2 = process.env.PULLFROG_BIN_NAME || "pullfrog";
+  return [
+    `${import_picocolors.default.cyan(params.name)} is already set on ${repos.map((repo) => import_picocolors.default.cyan(repo)).join(", ")}.`,
+    `a repo's own copy takes precedence, so saving to ${import_picocolors.default.cyan(params.owner)} would not change`,
+    `what runs there read.`,
+    ``,
+    `delete the repo copies, then run this command again:`,
+    ...repos.map(
+      (repo) => `  ${import_picocolors.default.cyan(`npx ${bin2} secret delete ${params.name} --repo ${repo}`)}`
+    ),
+    ``,
+    `${import_picocolors.default.dim("or:")} pass ${import_picocolors.default.cyan("--repo OWNER/REPO")} to replace one repo's own copy instead.`
+  ].join("\n");
+}
 var activeSpin = null;
 function setActiveSpin(spin) {
   activeSpin = spin;
@@ -123360,6 +123386,9 @@ var secretNamesSchema = external_exports.object({
   target: external_exports.string(),
   secrets: external_exports.array(external_exports.string()),
   inherited: external_exports.array(external_exports.string()),
+  // `.default([])` so a CLI newer than its server — a preview deployment, a self-hosted
+  // install — keeps working: every command parses this shape, not just `auth`.
+  overrides: external_exports.array(external_exports.object({ name: external_exports.string(), repo: external_exports.string() })).default([]),
   writable: external_exports.boolean()
 });
 async function runCli(input2) {
@@ -123429,6 +123458,10 @@ use auth codex, auth claude or auth grok for subscription credentials.`);
       throw new Error("--file requires exactly one secret name");
     if (file3 === void 0 && !process.stdin.isTTY)
       throw new Error("use --file PATH or --file - without a terminal");
+    for (const name of names.filter((secret) => SUBSCRIPTION_SECRET_NAMES.includes(secret))) {
+      const refusal = shadowRefusal({ overrides: data.overrides, owner: target.owner, name });
+      if (refusal) throw new Error(refusal);
+    }
     const secrets = [];
     for (const name of names) {
       const value2 = file3 === void 0 ? await password({
@@ -123445,9 +123478,6 @@ use auth codex, auth claude or auth grok for subscription credentials.`);
 }
 
 // commands/auth.ts
-var CODEX_AUTH_SECRET = "CODEX_AUTH_JSON";
-var CLAUDE_OAUTH_SECRET = "CLAUDE_CODE_OAUTH_TOKEN";
-var GROK_AUTH_SECRET = "GROK_AUTH_JSON";
 var CLAUDE_OAUTH_TOKEN_PREFIX = "sk-ant-oat";
 function stripAnsi(s) {
   return s.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
@@ -123561,6 +123591,16 @@ async function runCodex(params) {
   if (parsed2._.length) throw new Error("unexpected auth argument");
   await runCodexAuth(parsed2);
 }
+function refuseWhenRepoCopiesShadow(params) {
+  const refusal = shadowRefusal({
+    overrides: params.access.overrides,
+    owner: params.owner,
+    name: params.name
+  });
+  if (!refusal) return;
+  log.warn(refusal);
+  bail("nothing saved.");
+}
 async function runCodexAuth(parsed2) {
   intro(import_picocolors2.default.bgGreen(import_picocolors2.default.black(" pullfrog auth codex ")));
   const spin = spinner();
@@ -123601,6 +123641,7 @@ async function runCodexAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
+    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: CODEX_AUTH_SECRET });
     if (access.secrets.includes(CODEX_AUTH_SECRET)) {
       const overwrite = await select({
         message: `${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} is already configured \u2014 overwrite?`,
@@ -123777,6 +123818,7 @@ async function runClaudeAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
+    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: CLAUDE_OAUTH_SECRET });
     if (access.secrets.includes(CLAUDE_OAUTH_SECRET)) {
       const overwrite = await select({
         message: `${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} is already configured \u2014 overwrite?`,
@@ -123911,6 +123953,7 @@ async function runGrokAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
+    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: GROK_AUTH_SECRET });
     if (access.secrets.includes(GROK_AUTH_SECRET)) {
       const overwrite = await select({
         message: `${import_picocolors2.default.cyan(GROK_AUTH_SECRET)} is already configured \u2014 overwrite?`,
@@ -125535,9 +125578,9 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
@@ -125560,6 +125603,17 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -215186,6 +215240,115 @@ function subagentDeniedToolNames(ctx, outputSchema) {
   return names;
 }
 
+// utils/providerDashboards.ts
+var PROVIDER_DASHBOARDS = {
+  anthropic: {
+    name: "Anthropic",
+    billing: "https://platform.claude.com/settings/billing",
+    usage: "https://platform.claude.com/usage",
+    keys: "https://platform.claude.com/settings/keys"
+  },
+  "claude-plan": {
+    name: "Claude Pro/Max",
+    credential: "CLAUDE_CODE_OAUTH_TOKEN",
+    billing: "https://claude.ai/settings/billing",
+    usage: "https://claude.ai/settings/usage"
+  },
+  openai: {
+    name: "OpenAI",
+    billing: "https://platform.openai.com/settings/organization/billing/overview",
+    usage: "https://platform.openai.com/settings/organization/usage",
+    keys: "https://platform.openai.com/api-keys"
+  },
+  "codex-plan": {
+    name: "ChatGPT/Codex",
+    credential: "CODEX_AUTH_JSON",
+    billing: "https://chatgpt.com/#settings/Subscription",
+    usage: "https://chatgpt.com/codex/settings/usage"
+  },
+  google: {
+    name: "Google AI Studio",
+    // AI Studio's "Usage & billing" page is where the Gemini API plan lives;
+    // the Cloud billing console is a level up and needs a project picked.
+    billing: "https://aistudio.google.com/usage",
+    keys: "https://aistudio.google.com/apikey"
+  },
+  vertex: {
+    name: "Google Vertex AI",
+    billing: "https://console.cloud.google.com/billing",
+    usage: "https://console.cloud.google.com/vertex-ai"
+  },
+  xai: {
+    name: "xAI",
+    billing: "https://console.x.ai/team/default/billing",
+    usage: "https://console.x.ai/team/default/usage",
+    keys: "https://console.x.ai/team/default/api-keys"
+  },
+  "grok-plan": {
+    name: "SuperGrok",
+    credential: "GROK_AUTH_JSON",
+    billing: "https://grok.com/?_s=billing"
+  },
+  deepseek: {
+    name: "DeepSeek",
+    billing: "https://platform.deepseek.com/top_up",
+    usage: "https://platform.deepseek.com/usage",
+    keys: "https://platform.deepseek.com/api_keys"
+  },
+  moonshotai: {
+    name: "Moonshot (Kimi API)",
+    billing: "https://platform.kimi.ai/console/pay",
+    usage: "https://platform.kimi.ai/console/account",
+    keys: "https://platform.kimi.ai/console/api-keys"
+  },
+  "kimi-for-coding": {
+    name: "Kimi Code",
+    billing: "https://www.kimi.com/membership/pricing",
+    keys: "https://www.kimi.com/code/console"
+  },
+  meta: {
+    name: "Meta Model API",
+    billing: "https://dev.meta.ai/billing",
+    usage: "https://dev.meta.ai/usage",
+    keys: "https://dev.meta.ai/api-keys"
+  },
+  opencode: {
+    name: "OpenCode Zen",
+    billing: "https://opencode.ai/zen",
+    keys: "https://opencode.ai/zen"
+  },
+  // Go is a separate plan on the same key, with its own usage cap that resets
+  // on its own (wiki/opencode-silent-stall.md). Its page is the plan page; no
+  // per-window usage page is documented.
+  "opencode-go": {
+    name: "OpenCode Go",
+    billing: "https://opencode.ai/go",
+    keys: "https://opencode.ai/zen"
+  },
+  openrouter: {
+    name: "OpenRouter",
+    billing: "https://openrouter.ai/settings/credits",
+    usage: "https://openrouter.ai/activity",
+    keys: "https://openrouter.ai/workspaces/default/keys"
+  },
+  vercel: {
+    name: "Vercel AI Gateway",
+    // `/d?to=` resolves `[team]` to whichever team the visitor is signed into.
+    billing: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway",
+    keys: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway%2Fapi-keys"
+  },
+  bedrock: {
+    name: "Amazon Bedrock",
+    billing: "https://console.aws.amazon.com/billing/home",
+    keys: "https://us-east-1.console.aws.amazon.com/bedrock/home#/api-keys"
+  },
+  // Azure OpenAI keys are per-resource, so there is no stable keys page to name.
+  azure: {
+    name: "Azure OpenAI",
+    billing: "https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/overview"
+  }
+};
+
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
 var BYOK_SLUG_MARKER = "env var is required when the model is set to";
@@ -215510,14 +215673,22 @@ function buildRejectedCredentialError(params) {
     ].join("\n");
   }
   const where = params.inPullfrogStore ? `[Update it in Pullfrog \u2192](${settingsUrl})` : `[Update the GitHub Actions secret \u2192](https://github.com/${params.owner}/${params.name}/settings/secrets/actions)`;
+  const keysUrl = providerKeysUrl(params.credential);
+  const issue4 = keysUrl ? `[Issue a new key \u2192](${keysUrl}) \xB7 ` : "";
   return [
     `**Your \`${params.credential}\` ${CREDENTIAL_REJECTED_MARKER}**${detail}, so the agent never ran.`,
     "",
     `**To fix:** issue a new key in your provider dashboard and update the copy Pullfrog uses${params.inPullfrogStore ? " in the console" : " in your repo's GitHub Actions secrets"}.`,
     "",
-    `${where} \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    `${issue4}${where} \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
   ].join("\n");
 }
+function providerKeysUrl(credential) {
+  for (const [id, provider2] of Object.entries(providers)) {
+    if (provider2.envVars.includes(credential)) return PROVIDER_DASHBOARDS[id]?.keys;
+  }
+  return void 0;
+}
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
     if (params.raw.startsWith(`**${MISSING_KEY_MARKER}**`)) return params.raw;
@@ -215709,23 +215880,35 @@ function billingConsoleUrl(owner) {
   return `https://pullfrog.com/console/${encodeURIComponent(owner)}#billing`;
 }
 function commercialPaywallBody(params) {
-  if (params.reason === "commercial") {
-    return [
-      `**Pullfrog needs Pro on ${params.ownerLogin}, so this run didn't start.**`,
-      "",
-      "Pro is $30/month per organization and covers private repositories. Public repos and personal accounts keep running free.",
-      "",
-      `[Upgrade to Pro \u2192](${params.url})`
-    ].join("\n");
+  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  switch (params.reason) {
+    case "commercial":
+      return [
+        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
+        "",
+        pitch,
+        "",
+        `[Upgrade now \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_ended":
+      return [
+        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
+        "",
+        pitch,
+        "",
+        `[Resubscribe \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_unpaid":
+      return [
+        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
+        "",
+        "Update the card on file to resume runs.",
+        "",
+        `[Update billing \u2192](${params.url})`
+      ].join("\n");
+    default:
+      return params.reason;
   }
-  params.reason;
-  return [
-    `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-    "",
-    "Update the card on file to resume runs.",
-    "",
-    `[Update billing \u2192](${params.url})`
-  ].join("\n");
 }
 function formatCommercialGateSummary(params) {
   return commercialPaywallBody({
@@ -215777,6 +215960,12 @@ function formatBillingErrorSummary(error109, owner) {
       ownerLogin: owner
     });
   }
+  if (error109.code === "subscription_ended") {
+    return formatCommercialGateSummary({
+      reason: "subscription_ended",
+      ownerLogin: owner
+    });
+  }
   if (error109.code === "subscription_unpaid") {
     return formatCommercialGateSummary({
       reason: "subscription_unpaid",
@@ -217689,8 +217878,9 @@ async function fetchRunContext(params) {
     clearTimeout(timeoutId);
     if (response.status === 402) {
       const body = await response.json().catch(() => null);
-      const reason = typeof body === "object" && body !== null && "reason" in body && body.reason === "subscription_unpaid" ? "subscription_unpaid" : "commercial";
-      return { ...defaultRunContext, commercialRefused: reason };
+      const reason = typeof body === "object" && body !== null && "reason" in body ? body.reason : null;
+      const commercialRefused = reason === "subscription_unpaid" || reason === "subscription_ended" ? reason : "commercial";
+      return { ...defaultRunContext, commercialRefused };
     }
     if (!response.ok) {
       return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
@@ -217930,15 +218120,9 @@ function formatMinimalFailureComment(repo) {
   const url5 = `${server}/${repo.owner}/${repo.name}/actions/runs/${runId}`;
   return `**Run failed.** [View the logs \u2192](${url5})`;
 }
-var PROVIDER_BILLING_URLS = {
-  deepseek: "https://platform.deepseek.com/top_up",
-  anthropic: "https://console.anthropic.com/settings/billing",
-  openai: "https://platform.openai.com/account/billing",
-  google: "https://aistudio.google.com/usage",
-  opencode: "https://opencode.ai/zen",
-  xai: "https://console.x.ai/team/default/billing",
-  openrouter: "https://openrouter.ai/settings/credits"
-};
+var PROVIDER_BILLING_URLS = Object.fromEntries(
+  Object.entries(PROVIDER_DASHBOARDS).map(([id, dashboard]) => [id, dashboard.billing])
+);
 function detectProviderId(message) {
   const harnessId = extractProviderId(message);
   if (harnessId) return harnessId;
@@ -217949,7 +218133,6 @@ function detectProviderId(message) {
   }
   return null;
 }
-var OPENROUTER_KEYS_URL = "https://openrouter.ai/workspaces/default/keys";
 var OPENROUTER_PRIVACY_URL = "https://openrouter.ai/settings/privacy";
 function formatProviderBillingExhausted(input2) {
   const providerId = detectProviderId(input2.errorMessage);
@@ -217960,7 +218143,7 @@ function formatProviderBillingExhausted(input2) {
       "",
       "OpenRouter refused the request against the key's own spending ceiling, not your account balance \u2014 raising or removing that limit is the fix, and topping up credits alone may not be.",
       "",
-      `[Raise the key's limit \u2192](${OPENROUTER_KEYS_URL}) \xB7 [Add credits \u2192](${PROVIDER_BILLING_URLS.openrouter})`,
+      `[Raise the key's limit \u2192](${PROVIDER_DASHBOARDS.openrouter.keys}) \xB7 [Add credits \u2192](${PROVIDER_BILLING_URLS.openrouter})`,
       "",
       `\`\`\`
 ${input2.errorMessage}
@@ -218894,7 +219077,11 @@ async function main() {
           authorPermission: void 0,
           oidc: oidcCredentials
         }), true);
-        const errorMessage = runContext.commercialRefused === "subscription_unpaid" ? "Pro renewal failed for this organization" : "Pro plan required for this organization";
+        const errorMessage = {
+          commercial: "Pro trial expired for this organization",
+          subscription_ended: "Pro subscription ended for this organization",
+          subscription_unpaid: "Pro renewal failed for this organization"
+        }[runContext.commercialRefused];
         log2.error(errorMessage);
         const body = formatCommercialGateSummary({
           reason: runContext.commercialRefused,
@@ -219985,7 +220172,7 @@ function resolveTarget2(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.79");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.81");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -220152,7 +220339,7 @@ async function runCli8(input2) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.79";
+var VERSION10 = "0.1.81";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -108354,9 +108354,9 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
@@ -108379,6 +108379,17 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -109975,7 +109986,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.79",
+  version: "0.1.81",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -198046,6 +198057,115 @@ function subagentDeniedToolNames(ctx, outputSchema) {
   return names;
 }
 
+// utils/providerDashboards.ts
+var PROVIDER_DASHBOARDS = {
+  anthropic: {
+    name: "Anthropic",
+    billing: "https://platform.claude.com/settings/billing",
+    usage: "https://platform.claude.com/usage",
+    keys: "https://platform.claude.com/settings/keys"
+  },
+  "claude-plan": {
+    name: "Claude Pro/Max",
+    credential: "CLAUDE_CODE_OAUTH_TOKEN",
+    billing: "https://claude.ai/settings/billing",
+    usage: "https://claude.ai/settings/usage"
+  },
+  openai: {
+    name: "OpenAI",
+    billing: "https://platform.openai.com/settings/organization/billing/overview",
+    usage: "https://platform.openai.com/settings/organization/usage",
+    keys: "https://platform.openai.com/api-keys"
+  },
+  "codex-plan": {
+    name: "ChatGPT/Codex",
+    credential: "CODEX_AUTH_JSON",
+    billing: "https://chatgpt.com/#settings/Subscription",
+    usage: "https://chatgpt.com/codex/settings/usage"
+  },
+  google: {
+    name: "Google AI Studio",
+    // AI Studio's "Usage & billing" page is where the Gemini API plan lives;
+    // the Cloud billing console is a level up and needs a project picked.
+    billing: "https://aistudio.google.com/usage",
+    keys: "https://aistudio.google.com/apikey"
+  },
+  vertex: {
+    name: "Google Vertex AI",
+    billing: "https://console.cloud.google.com/billing",
+    usage: "https://console.cloud.google.com/vertex-ai"
+  },
+  xai: {
+    name: "xAI",
+    billing: "https://console.x.ai/team/default/billing",
+    usage: "https://console.x.ai/team/default/usage",
+    keys: "https://console.x.ai/team/default/api-keys"
+  },
+  "grok-plan": {
+    name: "SuperGrok",
+    credential: "GROK_AUTH_JSON",
+    billing: "https://grok.com/?_s=billing"
+  },
+  deepseek: {
+    name: "DeepSeek",
+    billing: "https://platform.deepseek.com/top_up",
+    usage: "https://platform.deepseek.com/usage",
+    keys: "https://platform.deepseek.com/api_keys"
+  },
+  moonshotai: {
+    name: "Moonshot (Kimi API)",
+    billing: "https://platform.kimi.ai/console/pay",
+    usage: "https://platform.kimi.ai/console/account",
+    keys: "https://platform.kimi.ai/console/api-keys"
+  },
+  "kimi-for-coding": {
+    name: "Kimi Code",
+    billing: "https://www.kimi.com/membership/pricing",
+    keys: "https://www.kimi.com/code/console"
+  },
+  meta: {
+    name: "Meta Model API",
+    billing: "https://dev.meta.ai/billing",
+    usage: "https://dev.meta.ai/usage",
+    keys: "https://dev.meta.ai/api-keys"
+  },
+  opencode: {
+    name: "OpenCode Zen",
+    billing: "https://opencode.ai/zen",
+    keys: "https://opencode.ai/zen"
+  },
+  // Go is a separate plan on the same key, with its own usage cap that resets
+  // on its own (wiki/opencode-silent-stall.md). Its page is the plan page; no
+  // per-window usage page is documented.
+  "opencode-go": {
+    name: "OpenCode Go",
+    billing: "https://opencode.ai/go",
+    keys: "https://opencode.ai/zen"
+  },
+  openrouter: {
+    name: "OpenRouter",
+    billing: "https://openrouter.ai/settings/credits",
+    usage: "https://openrouter.ai/activity",
+    keys: "https://openrouter.ai/workspaces/default/keys"
+  },
+  vercel: {
+    name: "Vercel AI Gateway",
+    // `/d?to=` resolves `[team]` to whichever team the visitor is signed into.
+    billing: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway",
+    keys: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway%2Fapi-keys"
+  },
+  bedrock: {
+    name: "Amazon Bedrock",
+    billing: "https://console.aws.amazon.com/billing/home",
+    keys: "https://us-east-1.console.aws.amazon.com/bedrock/home#/api-keys"
+  },
+  // Azure OpenAI keys are per-resource, so there is no stable keys page to name.
+  azure: {
+    name: "Azure OpenAI",
+    billing: "https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/overview"
+  }
+};
+
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
 var BYOK_SLUG_MARKER = "env var is required when the model is set to";
@@ -198370,14 +198490,22 @@ function buildRejectedCredentialError(params) {
     ].join("\n");
   }
   const where = params.inPullfrogStore ? `[Update it in Pullfrog \u2192](${settingsUrl})` : `[Update the GitHub Actions secret \u2192](https://github.com/${params.owner}/${params.name}/settings/secrets/actions)`;
+  const keysUrl = providerKeysUrl(params.credential);
+  const issue3 = keysUrl ? `[Issue a new key \u2192](${keysUrl}) \xB7 ` : "";
   return [
     `**Your \`${params.credential}\` ${CREDENTIAL_REJECTED_MARKER}**${detail}, so the agent never ran.`,
     "",
     `**To fix:** issue a new key in your provider dashboard and update the copy Pullfrog uses${params.inPullfrogStore ? " in the console" : " in your repo's GitHub Actions secrets"}.`,
     "",
-    `${where} \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    `${issue3}${where} \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
   ].join("\n");
 }
+function providerKeysUrl(credential) {
+  for (const [id, provider2] of Object.entries(providers)) {
+    if (provider2.envVars.includes(credential)) return PROVIDER_DASHBOARDS[id]?.keys;
+  }
+  return void 0;
+}
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
     if (params.raw.startsWith(`**${MISSING_KEY_MARKER}**`)) return params.raw;
@@ -198569,23 +198697,35 @@ function billingConsoleUrl(owner) {
   return `https://pullfrog.com/console/${encodeURIComponent(owner)}#billing`;
 }
 function commercialPaywallBody(params) {
-  if (params.reason === "commercial") {
-    return [
-      `**Pullfrog needs Pro on ${params.ownerLogin}, so this run didn't start.**`,
-      "",
-      "Pro is $30/month per organization and covers private repositories. Public repos and personal accounts keep running free.",
-      "",
-      `[Upgrade to Pro \u2192](${params.url})`
-    ].join("\n");
+  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  switch (params.reason) {
+    case "commercial":
+      return [
+        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
+        "",
+        pitch,
+        "",
+        `[Upgrade now \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_ended":
+      return [
+        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
+        "",
+        pitch,
+        "",
+        `[Resubscribe \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_unpaid":
+      return [
+        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
+        "",
+        "Update the card on file to resume runs.",
+        "",
+        `[Update billing \u2192](${params.url})`
+      ].join("\n");
+    default:
+      return params.reason;
   }
-  params.reason;
-  return [
-    `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-    "",
-    "Update the card on file to resume runs.",
-    "",
-    `[Update billing \u2192](${params.url})`
-  ].join("\n");
 }
 function formatCommercialGateSummary(params) {
   return commercialPaywallBody({
@@ -198637,6 +198777,12 @@ function formatBillingErrorSummary(error62, owner) {
       ownerLogin: owner
     });
   }
+  if (error62.code === "subscription_ended") {
+    return formatCommercialGateSummary({
+      reason: "subscription_ended",
+      ownerLogin: owner
+    });
+  }
   if (error62.code === "subscription_unpaid") {
     return formatCommercialGateSummary({
       reason: "subscription_unpaid",
@@ -200549,8 +200695,9 @@ async function fetchRunContext(params) {
     clearTimeout(timeoutId);
     if (response.status === 402) {
       const body = await response.json().catch(() => null);
-      const reason = typeof body === "object" && body !== null && "reason" in body && body.reason === "subscription_unpaid" ? "subscription_unpaid" : "commercial";
-      return { ...defaultRunContext, commercialRefused: reason };
+      const reason = typeof body === "object" && body !== null && "reason" in body ? body.reason : null;
+      const commercialRefused = reason === "subscription_unpaid" || reason === "subscription_ended" ? reason : "commercial";
+      return { ...defaultRunContext, commercialRefused };
     }
     if (!response.ok) {
       return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
@@ -200790,15 +200937,9 @@ function formatMinimalFailureComment(repo) {
   const url4 = `${server}/${repo.owner}/${repo.name}/actions/runs/${runId}`;
   return `**Run failed.** [View the logs \u2192](${url4})`;
 }
-var PROVIDER_BILLING_URLS = {
-  deepseek: "https://platform.deepseek.com/top_up",
-  anthropic: "https://console.anthropic.com/settings/billing",
-  openai: "https://platform.openai.com/account/billing",
-  google: "https://aistudio.google.com/usage",
-  opencode: "https://opencode.ai/zen",
-  xai: "https://console.x.ai/team/default/billing",
-  openrouter: "https://openrouter.ai/settings/credits"
-};
+var PROVIDER_BILLING_URLS = Object.fromEntries(
+  Object.entries(PROVIDER_DASHBOARDS).map(([id, dashboard]) => [id, dashboard.billing])
+);
 function detectProviderId(message) {
   const harnessId = extractProviderId(message);
   if (harnessId) return harnessId;
@@ -200809,7 +200950,6 @@ function detectProviderId(message) {
   }
   return null;
 }
-var OPENROUTER_KEYS_URL = "https://openrouter.ai/workspaces/default/keys";
 var OPENROUTER_PRIVACY_URL = "https://openrouter.ai/settings/privacy";
 function formatProviderBillingExhausted(input2) {
   const providerId = detectProviderId(input2.errorMessage);
@@ -200820,7 +200960,7 @@ function formatProviderBillingExhausted(input2) {
       "",
       "OpenRouter refused the request against the key's own spending ceiling, not your account balance \u2014 raising or removing that limit is the fix, and topping up credits alone may not be.",
       "",
-      `[Raise the key's limit \u2192](${OPENROUTER_KEYS_URL}) \xB7 [Add credits \u2192](${PROVIDER_BILLING_URLS.openrouter})`,
+      `[Raise the key's limit \u2192](${PROVIDER_DASHBOARDS.openrouter.keys}) \xB7 [Add credits \u2192](${PROVIDER_BILLING_URLS.openrouter})`,
       "",
       `\`\`\`
 ${input2.errorMessage}
@@ -201754,7 +201894,11 @@ async function main() {
           authorPermission: void 0,
           oidc: oidcCredentials
         }), true);
-        const errorMessage = runContext.commercialRefused === "subscription_unpaid" ? "Pro renewal failed for this organization" : "Pro plan required for this organization";
+        const errorMessage = {
+          commercial: "Pro trial expired for this organization",
+          subscription_ended: "Pro subscription ended for this organization",
+          subscription_unpaid: "Pro renewal failed for this organization"
+        }[runContext.commercialRefused];
         log.error(errorMessage);
         const body = formatCommercialGateSummary({
           reason: runContext.commercialRefused,

package/dist/internal/index.d.ts

@@ -9,7 +9,7 @@ export type { AuthorPermission, AutoTier, EffortPosition, ModelAlias, ModelProvi
 export { AUTO_EFFICIENT, AUTO_INTELLIGENT, AUTO_ROUTER, autoLadder, autoRoutedSlug, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoRouted, isAutoSlug, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, isRouterTier, ladderRungs, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, ossFundedModelNames, PROVIDER_GATEWAY_URL_ENV, parseEffortPosition, parseModel, providers, pullfrogMcpName, ROUTED_PROVIDERS, ROUTER_LADDER, ROUTER_TIERS, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRoutedModel, resolveRung, rungLabel, rungPosition, SUBSIDY_RUNG, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
-export { commercialPaywallBody } from "../utils/billingErrors.ts";
+export { type CommercialRefusal, commercialPaywallBody } from "../utils/billingErrors.ts";
 export type { BuildPullfrogFooterParams, WorkflowRunFooterInfo, } from "../utils/buildPullfrogFooter.ts";
 export { buildPullfrogFooter, PULLFROG_DIVIDER, stripExistingFooter, } from "../utils/buildPullfrogFooter.ts";
 export type { CodexAuthBody } from "../utils/codexOAuth.ts";
@@ -22,6 +22,7 @@ export { isLeapingIntoActionCommentBody, LEAPING_INTO_ACTION_PREFIX, } from "../
 export { MAX_LEARNINGS_LENGTH, truncateAtLineBoundary } from "../utils/learningsTruncate.ts";
 export type { CreateProgressCommentTarget, ProgressComment, ProgressCommentType, } from "../utils/progressComment.ts";
 export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComment, updateProgressComment, } from "../utils/progressComment.ts";
+export { PROVIDER_DASHBOARDS, type ProviderDashboard } from "../utils/providerDashboards.ts";
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.79",
+  version: "0.1.81",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -14922,9 +14922,9 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
@@ -14947,6 +14947,17 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -16151,23 +16162,35 @@ var modes = computeModes("opencode");
 
 // utils/billingErrors.ts
 function commercialPaywallBody(params) {
-  if (params.reason === "commercial") {
-    return [
-      `**Pullfrog needs Pro on ${params.ownerLogin}, so this run didn't start.**`,
-      "",
-      "Pro is $30/month per organization and covers private repositories. Public repos and personal accounts keep running free.",
-      "",
-      `[Upgrade to Pro \u2192](${params.url})`
-    ].join("\n");
-  }
-  params.reason;
-  return [
-    `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-    "",
-    "Update the card on file to resume runs.",
-    "",
-    `[Update billing \u2192](${params.url})`
-  ].join("\n");
+  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  switch (params.reason) {
+    case "commercial":
+      return [
+        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
+        "",
+        pitch,
+        "",
+        `[Upgrade now \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_ended":
+      return [
+        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
+        "",
+        pitch,
+        "",
+        `[Resubscribe \u2192](${params.url})`
+      ].join("\n");
+    case "subscription_unpaid":
+      return [
+        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
+        "",
+        "Update the card on file to resume runs.",
+        "",
+        `[Update billing \u2192](${params.url})`
+      ].join("\n");
+    default:
+      return params.reason;
+  }
 }
 
 // utils/buildPullfrogFooter.ts
@@ -16300,10 +16323,10 @@ function decodeJwtExpMs(token) {
 // utils/codexOAuth.ts
 var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
-function codexChainIsDead(body) {
+function codexChainIsDead(status, body) {
+  if (status !== 401) return false;
   const err = parseOAuthErrorBody(body)?.error;
-  if (!err || typeof err !== "object") return false;
-  return "code" in err && err.code === "token_expired";
+  return !(err && typeof err === "object" && "code" in err && err.code === "invalid_client");
 }
 async function refreshCodexAuthBody(body) {
   const response = await fetch(CODEX_OAUTH_TOKEN_URL, {
@@ -16319,7 +16342,12 @@ async function refreshCodexAuthBody(body) {
   if (!response.ok) {
     const text = await response.text().catch(() => "");
     if (response.status >= 400 && response.status < 500) {
-      throw new OAuthInvalidGrantError("Codex", response.status, text, codexChainIsDead(text));
+      throw new OAuthInvalidGrantError(
+        "Codex",
+        response.status,
+        text,
+        codexChainIsDead(response.status, text)
+      );
     }
     throw new Error(`Codex token refresh failed: ${response.status} ${text}`);
   }
@@ -16598,6 +16626,115 @@ async function createLeapingProgressComment(ctx, target, body) {
   };
 }
 
+// utils/providerDashboards.ts
+var PROVIDER_DASHBOARDS = {
+  anthropic: {
+    name: "Anthropic",
+    billing: "https://platform.claude.com/settings/billing",
+    usage: "https://platform.claude.com/usage",
+    keys: "https://platform.claude.com/settings/keys"
+  },
+  "claude-plan": {
+    name: "Claude Pro/Max",
+    credential: "CLAUDE_CODE_OAUTH_TOKEN",
+    billing: "https://claude.ai/settings/billing",
+    usage: "https://claude.ai/settings/usage"
+  },
+  openai: {
+    name: "OpenAI",
+    billing: "https://platform.openai.com/settings/organization/billing/overview",
+    usage: "https://platform.openai.com/settings/organization/usage",
+    keys: "https://platform.openai.com/api-keys"
+  },
+  "codex-plan": {
+    name: "ChatGPT/Codex",
+    credential: "CODEX_AUTH_JSON",
+    billing: "https://chatgpt.com/#settings/Subscription",
+    usage: "https://chatgpt.com/codex/settings/usage"
+  },
+  google: {
+    name: "Google AI Studio",
+    // AI Studio's "Usage & billing" page is where the Gemini API plan lives;
+    // the Cloud billing console is a level up and needs a project picked.
+    billing: "https://aistudio.google.com/usage",
+    keys: "https://aistudio.google.com/apikey"
+  },
+  vertex: {
+    name: "Google Vertex AI",
+    billing: "https://console.cloud.google.com/billing",
+    usage: "https://console.cloud.google.com/vertex-ai"
+  },
+  xai: {
+    name: "xAI",
+    billing: "https://console.x.ai/team/default/billing",
+    usage: "https://console.x.ai/team/default/usage",
+    keys: "https://console.x.ai/team/default/api-keys"
+  },
+  "grok-plan": {
+    name: "SuperGrok",
+    credential: "GROK_AUTH_JSON",
+    billing: "https://grok.com/?_s=billing"
+  },
+  deepseek: {
+    name: "DeepSeek",
+    billing: "https://platform.deepseek.com/top_up",
+    usage: "https://platform.deepseek.com/usage",
+    keys: "https://platform.deepseek.com/api_keys"
+  },
+  moonshotai: {
+    name: "Moonshot (Kimi API)",
+    billing: "https://platform.kimi.ai/console/pay",
+    usage: "https://platform.kimi.ai/console/account",
+    keys: "https://platform.kimi.ai/console/api-keys"
+  },
+  "kimi-for-coding": {
+    name: "Kimi Code",
+    billing: "https://www.kimi.com/membership/pricing",
+    keys: "https://www.kimi.com/code/console"
+  },
+  meta: {
+    name: "Meta Model API",
+    billing: "https://dev.meta.ai/billing",
+    usage: "https://dev.meta.ai/usage",
+    keys: "https://dev.meta.ai/api-keys"
+  },
+  opencode: {
+    name: "OpenCode Zen",
+    billing: "https://opencode.ai/zen",
+    keys: "https://opencode.ai/zen"
+  },
+  // Go is a separate plan on the same key, with its own usage cap that resets
+  // on its own (wiki/opencode-silent-stall.md). Its page is the plan page; no
+  // per-window usage page is documented.
+  "opencode-go": {
+    name: "OpenCode Go",
+    billing: "https://opencode.ai/go",
+    keys: "https://opencode.ai/zen"
+  },
+  openrouter: {
+    name: "OpenRouter",
+    billing: "https://openrouter.ai/settings/credits",
+    usage: "https://openrouter.ai/activity",
+    keys: "https://openrouter.ai/workspaces/default/keys"
+  },
+  vercel: {
+    name: "Vercel AI Gateway",
+    // `/d?to=` resolves `[team]` to whichever team the visitor is signed into.
+    billing: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway",
+    keys: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway%2Fapi-keys"
+  },
+  bedrock: {
+    name: "Amazon Bedrock",
+    billing: "https://console.aws.amazon.com/billing/home",
+    keys: "https://us-east-1.console.aws.amazon.com/bedrock/home#/api-keys"
+  },
+  // Azure OpenAI keys are per-resource, so there is no stable keys page to name.
+  azure: {
+    name: "Azure OpenAI",
+    billing: "https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/overview"
+  }
+};
+
 // utils/runStatusCheck.ts
 var RUN_STATUS_CHECK_NAME = "pullfrog";
 var GITHUB_ACTIONS_APP_SLUG = "github-actions";
@@ -16806,6 +16943,7 @@ export {
   OAuthInvalidGrantError,
   OSS_MODEL_ALLOWLIST,
   OSS_RECOMMENDED_MODEL,
+  PROVIDER_DASHBOARDS,
   PROVIDER_GATEWAY_URL_ENV,
   PULLFROG_DIVIDER,
   ROUTED_PROVIDERS,

package/dist/utils/billingErrors.d.ts

@@ -43,6 +43,15 @@ export declare class BillingError extends Error {
 export declare class TransientError extends Error {
     constructor(message: string);
 }
+/**
+ * Why the org commercial gate refused a run (billing model v2), resolved by
+ * `resolveTeamRunAccess` and carried unchanged through the paywall comment, the
+ * run-context 402 and the proxy-token 402. `commercial`: the no-card trial
+ * wound down to `paused`. `subscription_ended`: a paid subscription was
+ * canceled and lapsed to `paused`. `subscription_unpaid`: the renewal failed
+ * dunning.
+ */
+export type CommercialRefusal = "commercial" | "subscription_ended" | "subscription_unpaid";
 /**
  * Canonical paused-run paywall body (billing model v2). Single source of truth so
  * the two surfaces that show it can never drift: the trigger-time comment (a run
@@ -51,7 +60,7 @@ export declare class TransientError extends Error {
  * caller's billing surface (each passes its own, internal plan page vs console).
  */
 export declare function commercialPaywallBody(params: {
-    reason: "commercial" | "subscription_unpaid";
+    reason: CommercialRefusal;
     ownerLogin: string;
     url: string;
 }): string;
@@ -65,7 +74,7 @@ export declare function commercialPaywallBody(params: {
  * production row; see `isSubscriptionHostTrusted` and wiki/billing-model-v2.md.
  */
 export declare function formatCommercialGateSummary(params: {
-    reason: "commercial" | "subscription_unpaid";
+    reason: CommercialRefusal;
     ownerLogin: string;
 }): string;
 /**

package/dist/utils/codexOAuth.d.ts

@@ -21,9 +21,8 @@ export interface CodexAuthBody {
     };
     last_refresh?: string;
     /**
-     * ISO timestamp of a rejection OpenAI attributed to the token itself
-     * (`error.code: "token_expired"` — it does not emit RFC 6749's
-     * `invalid_grant` here). OpenAI rotates the refresh
+     * ISO timestamp of a rejection OpenAI attributed to the token itself (a `401`
+     * other than `invalid_client` — see `codexChainIsDead`). OpenAI rotates the refresh
      * token on every use, so such a rejection is PERMANENT — without a latch the
      * server re-issued the identical doomed refresh on every run (455 futile
      * round trips in 7 days, one per run, each holding a Postgres row lock across

package/dist/utils/oauthShared.d.ts

@@ -11,12 +11,13 @@
  * Thrown when an OAuth provider rejects a refresh token (4xx).
  *
  * `chainIsDead` is decided by the CALLER, because the two providers we talk to
- * disagree about how to say it and only the caller knows its own dialect:
- * xAI answers RFC 6749 (`{"error":"invalid_grant"}`) while OpenAI nests an
- * object and discriminates on `error.code` (`token_expired`). A rejection we
- * cannot classify — a CDN error page in front of the token endpoint, say — is
- * NOT dead: latching there would retire every customer's working credential
- * over a transient edge event.
+ * disagree about how to say it and only the caller knows its own dialect, and
+ * so does the list of rejections that are NOT dead. xAI answers RFC 6749
+ * (`{"error":"invalid_grant"}`), so anything else — an unknown client id, an
+ * unsupported grant, a CDN error page — is spared. OpenAI answers a dead chain
+ * with a `401` whose body varies and is often empty, so there the `401` itself
+ * is the signal and only `invalid_client` is spared. Latching wrongly retires a
+ * customer's working credential until they re-mint it.
  */
 export declare class OAuthInvalidGrantError extends Error {
     readonly status: number;

package/dist/utils/providerDashboards.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Where each provider's own account lives, keyed by the provider id the rest of
+ * the runtime already uses (`providers` in `models.ts`, `providerID=` in the
+ * opencode log). Both failure surfaces read this one table — the per-run PR
+ * comment for its top-up CTA, and the diagnosis agent's link registry — so a
+ * host move is fixed in one place. Every catalog provider is here except
+ * `openai-compatible`, whose endpoint is the customer's own and has no page.
+ *
+ * How each path is known (2026-09-14), because "checked" means three different
+ * things here. Probed with a discriminating control — the path answers 200 and
+ * a junk path on the same host 404s: `platform.claude.com`, `platform.kimi.ai`,
+ * `www.kimi.com`, `dev.meta.ai`, `opencode.ai`, the AWS billing host.
+ * Taken from the provider's own docs, because the host answers a probe with a
+ * Cloudflare challenge or a catch-all login redirect that no junk path can
+ * distinguish: OpenAI, xAI, DeepSeek, `claude.ai`, `chatgpt.com`, Google,
+ * OpenRouter, Vercel, `grok.com`. Fragment routes (`#…`) never reach a server,
+ * so those rest on the docs alone. `console.anthropic.com` and
+ * `platform.moonshot.ai` both 301 now, so the entries name the hosts they land
+ * on.
+ *
+ * The subscription rows are not providers in the catalog sense — a Claude,
+ * ChatGPT or SuperGrok plan has a usage window and a plan page but no API key —
+ * so they carry the `-plan` suffix, no `keys`, and the credential that proves
+ * the plan is in play.
+ */
+export type ProviderDashboard = {
+    /** the name a customer knows the account by */
+    name: string;
+    /** a plan row only: the stored credential whose presence means the plan is in use */
+    credential?: string;
+    /** the wallet, the card on file, a spend cap, or the plan itself */
+    billing: string;
+    /** spend to date, or a plan's limit window and its reset time */
+    usage?: string;
+    /** where an API key is created or rotated */
+    keys?: string;
+};
+export declare const PROVIDER_DASHBOARDS: Record<string, ProviderDashboard>;

package/dist/utils/runContext.d.ts

@@ -1,5 +1,6 @@
 import type { PushPermission, ShellPermission } from "../external.ts";
 import type { RouterTier } from "../models.ts";
+import type { CommercialRefusal } from "./billingErrors.ts";
 import type { RepoContext } from "./github.ts";
 export interface Mode {
     id: string;
@@ -54,15 +55,6 @@ export interface RepoSettings {
  * `"none"` = no card; `"payg"` = card on file.
  */
 export type AccountPlan = "none" | "payg";
-/**
- * The org commercial gate's refusal (billing model v2). Set when run-context
- * returns 402 for a `paused`/`unpaid` org — the backstop for manual re-runs and
- * self-configured triggers that never hit reserveRun. main.ts stops before
- * installing the agent or loading account secrets and writes actionable copy.
- * A forked action can bypass this response, so proxy-token enforces the same
- * verdict before issuing a Pullfrog Router key.
- */
-export type CommercialRefusal = "commercial" | "subscription_unpaid";
 export interface RunContext {
     settings: RepoSettings;
     apiToken: string;
@@ -70,6 +62,14 @@ export interface RunContext {
     plan: AccountPlan;
     proxyModel?: string | undefined;
     dbSecrets?: Record<string, string> | undefined;
+    /**
+     * The org commercial gate's refusal (billing model v2). Set when run-context
+     * returns 402 for a `paused`/`unpaid` org — the backstop for manual re-runs and
+     * self-configured triggers that never hit reserveRun. main.ts stops before
+     * installing the agent or loading account secrets and writes actionable copy.
+     * A forked action can bypass this response, so proxy-token enforces the same
+     * verdict before issuing a Pullfrog Router key.
+     */
     commercialRefused?: CommercialRefusal | undefined;
     /**
      * the server tried and failed to materialize Pullfrog-stored secrets (or we

package/dist/utils/runContextData.d.ts

@@ -1,7 +1,8 @@
 import type { Octokit } from "@octokit/rest";
 import type { RouterTier } from "../models.ts";
+import type { CommercialRefusal } from "./billingErrors.ts";
 import { type OctokitWithPlugins } from "./github.ts";
-import { type AccountPlan, type CommercialRefusal, type RepoSettings } from "./runContext.ts";
+import { type AccountPlan, type RepoSettings } from "./runContext.ts";
 export interface RunContextData {
     repo: {
         owner: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.79",
+  "version": "0.1.81",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {