pullfrog 0.1.80 → 0.1.82

package/dist/agents/opencodePlugin.d.ts

@@ -81,5 +81,10 @@ export declare const PULLFROG_OPENCODE_PLUGIN_SOURCE: string;
  * session via `tool.execute.before`, complementing the runtime backstops from
  * PR #796 (action/mcp/checkout.ts, action/mcp/git.ts). Deny-list source of
  * truth: `action/agents/subagentToolGates.ts`.
+ *
+ * Also hard-blocks the native `bash` tool for EVERY session. bash stays in the
+ * tool list because Zen's free tier rejects a request without it (2026-09-17);
+ * `permission.bash: "ask"` is the fail-closed backstop should this plugin ever
+ * not load. see wiki/security.md.
  */
 export declare function buildOpencodeSubagentGateSource(deniedTools: readonly string[]): string;

package/dist/cli.mjs

@@ -123005,7 +123005,7 @@ var import_picocolors = __toESM(require_picocolors(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.80",
+  version: "0.1.82",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -125285,12 +125285,20 @@ var providers = {
   // the same models as `moonshotai` above, billed against a Kimi membership
   // instead of a Moonshot API balance — a separate endpoint, separate model
   // ids and a separate key, which is why it is a provider rather than a second
-  // `envVars` entry. no provider injection is needed: models.dev carries
-  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
-  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `envVars` entry. no provider injection is needed: models.dev carries the
+  // provider (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/openai-compatible`) and opencode's env loop enables it from a bare
   // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
   // ids list in `opencode models` and a run reaches Kimi's own auth check.
   //
+  // models.dev renamed that provider on 2026-09-18: `kimi-for-coding` became
+  // `kimi-code-plan-cn` (api.kimi.com — where the console mints the key) and
+  // `kimi-code-plan-global` (api.kimi.ai). opencode resolves providers from
+  // its models.dev cache, so a `resolve` still spelling the old key names a
+  // provider it does not know. the `resolve` targets track models.dev's key;
+  // the provider KEY below is Pullfrog's slug and stays put. see
+  // wiki/kimi-code.md.
+  //
   // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
   // membership, so a Router path here would silently bill the wallet for
   // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
@@ -125300,9 +125308,11 @@ var providers = {
   // keyless Router pick to the default subsidy model with `noRouterPath`.
   "kimi-for-coding": provider({
     // "Kimi Code" is the product name on kimi.com/code and in the console the
-    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
-    // is models.dev's id, so it is what `enabled_providers` and every
-    // `resolve` prefix must spell.
+    // key is minted from. the provider KEY stays `kimi-for-coding`: it is the
+    // slug prefix every stored pick, `--model` flag and BYOK card spells, and
+    // it is not what reaches opencode — `enabled_providers` is derived from
+    // the `resolve` prefix (`action/agents/opencode.ts`), which is why the
+    // two may differ here and nowhere else in this file.
     displayName: "Kimi Code",
     envVars: ["KIMI_API_KEY"],
     models: {
@@ -125313,7 +125323,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
-        resolve: "kimi-for-coding/k3",
+        resolve: "kimi-code-plan-cn/k3",
         effort: ["low", "high", "max"],
         subagentModel: "kimi-k2"
       },
@@ -125328,7 +125338,7 @@ var providers = {
       "kimi-k3-256k": {
         displayName: "Kimi K3 256K",
         description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
-        resolve: "kimi-for-coding/k3-256k",
+        resolve: "kimi-code-plan-cn/k3-256k",
         effort: ["low", "high", "max"],
         preferred: true,
         subagentModel: "kimi-k2"
@@ -125336,7 +125346,7 @@ var providers = {
       "kimi-k2": {
         displayName: "Kimi K2",
         description: "Included in every Kimi membership tier",
-        resolve: "kimi-for-coding/kimi-for-coding",
+        resolve: "kimi-code-plan-cn/kimi-for-coding",
         // models.dev published this ladder on 2026-09-14; the catalog gate
         // mirrors it, so main was red until the alias carried it too.
         effort: ["low", "high", "max"]
@@ -125344,7 +125354,7 @@ var providers = {
       "kimi-k2-highspeed": {
         displayName: "Kimi K2 HighSpeed",
         description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
-        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+        resolve: "kimi-code-plan-cn/kimi-for-coding-highspeed"
       }
     }
   }),
@@ -125578,17 +125588,21 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
       "muse-spark": {
         displayName: "Muse Spark",
         resolve: "opencode/muse-spark-1.3",
-        effort: ["minimal", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/meta/muse-spark-1.3"
+        // models.dev dropped `max` from Zen's ladder on 2026-09-19 while the
+        // OpenRouter and direct `meta/` routes kept it; the catalog gate
+        // mirrors what is published per route.
+        effort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/meta/muse-spark-1.3",
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh", "max"]
       },
       // Zen's FREE contributor tier: the same model at $0 because Meta trains
       // on the prompts and completions. Zen served it to our key on 2026-09-12
@@ -125603,6 +125617,22 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true,
+        // Zen dropped the id from `/v1/models` on 2026-09-18, two days after it
+        // listed it, and answers a 500 for it. a stealth preview has no same-
+        // family successor, so stored picks land on the other free stealth
+        // model, as `minimax-m2.5-free` does.
+        fallback: "opencode/big-pickle"
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -135867,6 +135897,11 @@ export default async function pullfrogSubagentGatePlugin() {
       // pick a different action.
       const sessionID = typeof input?.sessionID === "string" ? input.sessionID : "";
       const tool = typeof input?.tool === "string" ? input.tool : "";
+      // above the sessionID check: the bash block must never depend on a
+      // session id being present.
+      if (tool === "bash") {
+        throw new Error("the native bash tool is disabled in Pullfrog runs.");
+      }
       if (!sessionID || !tool) return;
       if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
       if (sessionID === orchestratorSessionID) return;
@@ -136079,7 +136114,11 @@ var installCli = () => installOpencodeCli({ binPath: "bin/opencode.exe" });
 function buildSecurityConfig(ctx, model) {
   const config4 = {
     permission: {
-      bash: "deny",
+      // listed but never run: Zen's free tier 403s a tool list missing `bash`,
+      // `glob`, `grep` or `read` (2026-09-17), so the gate plugin throws on
+      // every bash call and "ask" (no responder in serve mode) fails closed.
+      // never switch one of those four to "deny". see wiki/security.md.
+      bash: "ask",
       edit: "allow",
       read: "allow",
       webfetch: "allow",
@@ -218065,6 +218104,23 @@ function isContextOverflowError(message) {
 function isNoProviderAvailableError(message) {
   return /\bNo provider available\b/i.test(message);
 }
+function isZenFreeTierGateError(message) {
+  return /free tier can only be used from within OpenCode/i.test(message);
+}
+function formatZenFreeTierGateSummary(input2) {
+  const settingsUrl = `${getApiUrl()}/console/${input2.owner}/${input2.name}`;
+  return [
+    "**Zen's free tier refused a request this run made.** OpenCode Zen currently rejects free-model requests whose tool list is missing one of the built-in tools it expects ([upstream issue](https://github.com/anomalyco/opencode/issues/49587)). Pullfrog sends all of them, but opencode's mid-run context-compaction request carries no tools at all, and a repo-level `opencode.json` that denies `bash`, `glob`, `grep` or `read` strips that tool from every request.",
+    "",
+    'Pick a paid model for this repo, drop any `"deny"` on `bash`, `glob`, `grep` or `read` from the repo\'s `opencode.json` if it sets one, or split the PR so the run stays under the compaction threshold and re-trigger.',
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`,
+    "",
+    `\`\`\`
+${input2.raw}
+\`\`\``
+  ].join("\n");
+}
 function formatNoProviderAvailableSummary(input2) {
   const settingsUrl = `${getApiUrl()}/console/${input2.owner}/${input2.name}`;
   return [
@@ -218308,6 +218364,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isZenFreeTierGateError(input2.errorMessage)) {
+    const body = formatZenFreeTierGateSummary({
+      owner: input2.repo.owner,
+      name: input2.repo.name,
+      raw: input2.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   if (isContextOverflowError(input2.errorMessage)) {
@@ -220161,7 +220227,7 @@ function resolveTarget2(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.80");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.82");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -220328,7 +220394,7 @@ async function runCli8(input2) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.80";
+var VERSION10 = "0.1.82";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -108061,12 +108061,20 @@ var providers = {
   // the same models as `moonshotai` above, billed against a Kimi membership
   // instead of a Moonshot API balance — a separate endpoint, separate model
   // ids and a separate key, which is why it is a provider rather than a second
-  // `envVars` entry. no provider injection is needed: models.dev carries
-  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
-  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `envVars` entry. no provider injection is needed: models.dev carries the
+  // provider (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/openai-compatible`) and opencode's env loop enables it from a bare
   // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
   // ids list in `opencode models` and a run reaches Kimi's own auth check.
   //
+  // models.dev renamed that provider on 2026-09-18: `kimi-for-coding` became
+  // `kimi-code-plan-cn` (api.kimi.com — where the console mints the key) and
+  // `kimi-code-plan-global` (api.kimi.ai). opencode resolves providers from
+  // its models.dev cache, so a `resolve` still spelling the old key names a
+  // provider it does not know. the `resolve` targets track models.dev's key;
+  // the provider KEY below is Pullfrog's slug and stays put. see
+  // wiki/kimi-code.md.
+  //
   // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
   // membership, so a Router path here would silently bill the wallet for
   // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
@@ -108076,9 +108084,11 @@ var providers = {
   // keyless Router pick to the default subsidy model with `noRouterPath`.
   "kimi-for-coding": provider({
     // "Kimi Code" is the product name on kimi.com/code and in the console the
-    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
-    // is models.dev's id, so it is what `enabled_providers` and every
-    // `resolve` prefix must spell.
+    // key is minted from. the provider KEY stays `kimi-for-coding`: it is the
+    // slug prefix every stored pick, `--model` flag and BYOK card spells, and
+    // it is not what reaches opencode — `enabled_providers` is derived from
+    // the `resolve` prefix (`action/agents/opencode.ts`), which is why the
+    // two may differ here and nowhere else in this file.
     displayName: "Kimi Code",
     envVars: ["KIMI_API_KEY"],
     models: {
@@ -108089,7 +108099,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
-        resolve: "kimi-for-coding/k3",
+        resolve: "kimi-code-plan-cn/k3",
         effort: ["low", "high", "max"],
         subagentModel: "kimi-k2"
       },
@@ -108104,7 +108114,7 @@ var providers = {
       "kimi-k3-256k": {
         displayName: "Kimi K3 256K",
         description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
-        resolve: "kimi-for-coding/k3-256k",
+        resolve: "kimi-code-plan-cn/k3-256k",
         effort: ["low", "high", "max"],
         preferred: true,
         subagentModel: "kimi-k2"
@@ -108112,7 +108122,7 @@ var providers = {
       "kimi-k2": {
         displayName: "Kimi K2",
         description: "Included in every Kimi membership tier",
-        resolve: "kimi-for-coding/kimi-for-coding",
+        resolve: "kimi-code-plan-cn/kimi-for-coding",
         // models.dev published this ladder on 2026-09-14; the catalog gate
         // mirrors it, so main was red until the alias carried it too.
         effort: ["low", "high", "max"]
@@ -108120,7 +108130,7 @@ var providers = {
       "kimi-k2-highspeed": {
         displayName: "Kimi K2 HighSpeed",
         description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
-        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+        resolve: "kimi-code-plan-cn/kimi-for-coding-highspeed"
       }
     }
   }),
@@ -108354,17 +108364,21 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
       "muse-spark": {
         displayName: "Muse Spark",
         resolve: "opencode/muse-spark-1.3",
-        effort: ["minimal", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/meta/muse-spark-1.3"
+        // models.dev dropped `max` from Zen's ladder on 2026-09-19 while the
+        // OpenRouter and direct `meta/` routes kept it; the catalog gate
+        // mirrors what is published per route.
+        effort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/meta/muse-spark-1.3",
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh", "max"]
       },
       // Zen's FREE contributor tier: the same model at $0 because Meta trains
       // on the prompts and completions. Zen served it to our key on 2026-09-12
@@ -108379,6 +108393,22 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true,
+        // Zen dropped the id from `/v1/models` on 2026-09-18, two days after it
+        // listed it, and answers a 500 for it. a stealth preview has no same-
+        // family successor, so stored picks land on the other free stealth
+        // model, as `minimax-m2.5-free` does.
+        fallback: "opencode/big-pickle"
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -109975,7 +110005,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.80",
+  version: "0.1.82",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -118684,6 +118714,11 @@ export default async function pullfrogSubagentGatePlugin() {
       // pick a different action.
       const sessionID = typeof input?.sessionID === "string" ? input.sessionID : "";
       const tool = typeof input?.tool === "string" ? input.tool : "";
+      // above the sessionID check: the bash block must never depend on a
+      // session id being present.
+      if (tool === "bash") {
+        throw new Error("the native bash tool is disabled in Pullfrog runs.");
+      }
       if (!sessionID || !tool) return;
       if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
       if (sessionID === orchestratorSessionID) return;
@@ -118896,7 +118931,11 @@ var installCli = () => installOpencodeCli({ binPath: "bin/opencode.exe" });
 function buildSecurityConfig(ctx, model) {
   const config3 = {
     permission: {
-      bash: "deny",
+      // listed but never run: Zen's free tier 403s a tool list missing `bash`,
+      // `glob`, `grep` or `read` (2026-09-17), so the gate plugin throws on
+      // every bash call and "ask" (no responder in serve mode) fails closed.
+      // never switch one of those four to "deny". see wiki/security.md.
+      bash: "ask",
       edit: "allow",
       read: "allow",
       webfetch: "allow",
@@ -200882,6 +200921,23 @@ function isContextOverflowError(message) {
 function isNoProviderAvailableError(message) {
   return /\bNo provider available\b/i.test(message);
 }
+function isZenFreeTierGateError(message) {
+  return /free tier can only be used from within OpenCode/i.test(message);
+}
+function formatZenFreeTierGateSummary(input2) {
+  const settingsUrl = `${getApiUrl()}/console/${input2.owner}/${input2.name}`;
+  return [
+    "**Zen's free tier refused a request this run made.** OpenCode Zen currently rejects free-model requests whose tool list is missing one of the built-in tools it expects ([upstream issue](https://github.com/anomalyco/opencode/issues/49587)). Pullfrog sends all of them, but opencode's mid-run context-compaction request carries no tools at all, and a repo-level `opencode.json` that denies `bash`, `glob`, `grep` or `read` strips that tool from every request.",
+    "",
+    'Pick a paid model for this repo, drop any `"deny"` on `bash`, `glob`, `grep` or `read` from the repo\'s `opencode.json` if it sets one, or split the PR so the run stays under the compaction threshold and re-trigger.',
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`,
+    "",
+    `\`\`\`
+${input2.raw}
+\`\`\``
+  ].join("\n");
+}
 function formatNoProviderAvailableSummary(input2) {
   const settingsUrl = `${getApiUrl()}/console/${input2.owner}/${input2.name}`;
   return [
@@ -201125,6 +201181,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isZenFreeTierGateError(input2.errorMessage)) {
+    const body = formatZenFreeTierGateSummary({
+      owner: input2.repo.owner,
+      name: input2.repo.name,
+      raw: input2.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   if (isContextOverflowError(input2.errorMessage)) {

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.80",
+  version: "0.1.82",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -14629,12 +14629,20 @@ var providers = {
   // the same models as `moonshotai` above, billed against a Kimi membership
   // instead of a Moonshot API balance — a separate endpoint, separate model
   // ids and a separate key, which is why it is a provider rather than a second
-  // `envVars` entry. no provider injection is needed: models.dev carries
-  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
-  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `envVars` entry. no provider injection is needed: models.dev carries the
+  // provider (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/openai-compatible`) and opencode's env loop enables it from a bare
   // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
   // ids list in `opencode models` and a run reaches Kimi's own auth check.
   //
+  // models.dev renamed that provider on 2026-09-18: `kimi-for-coding` became
+  // `kimi-code-plan-cn` (api.kimi.com — where the console mints the key) and
+  // `kimi-code-plan-global` (api.kimi.ai). opencode resolves providers from
+  // its models.dev cache, so a `resolve` still spelling the old key names a
+  // provider it does not know. the `resolve` targets track models.dev's key;
+  // the provider KEY below is Pullfrog's slug and stays put. see
+  // wiki/kimi-code.md.
+  //
   // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
   // membership, so a Router path here would silently bill the wallet for
   // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
@@ -14644,9 +14652,11 @@ var providers = {
   // keyless Router pick to the default subsidy model with `noRouterPath`.
   "kimi-for-coding": provider({
     // "Kimi Code" is the product name on kimi.com/code and in the console the
-    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
-    // is models.dev's id, so it is what `enabled_providers` and every
-    // `resolve` prefix must spell.
+    // key is minted from. the provider KEY stays `kimi-for-coding`: it is the
+    // slug prefix every stored pick, `--model` flag and BYOK card spells, and
+    // it is not what reaches opencode — `enabled_providers` is derived from
+    // the `resolve` prefix (`action/agents/opencode.ts`), which is why the
+    // two may differ here and nowhere else in this file.
     displayName: "Kimi Code",
     envVars: ["KIMI_API_KEY"],
     models: {
@@ -14657,7 +14667,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
-        resolve: "kimi-for-coding/k3",
+        resolve: "kimi-code-plan-cn/k3",
         effort: ["low", "high", "max"],
         subagentModel: "kimi-k2"
       },
@@ -14672,7 +14682,7 @@ var providers = {
       "kimi-k3-256k": {
         displayName: "Kimi K3 256K",
         description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
-        resolve: "kimi-for-coding/k3-256k",
+        resolve: "kimi-code-plan-cn/k3-256k",
         effort: ["low", "high", "max"],
         preferred: true,
         subagentModel: "kimi-k2"
@@ -14680,7 +14690,7 @@ var providers = {
       "kimi-k2": {
         displayName: "Kimi K2",
         description: "Included in every Kimi membership tier",
-        resolve: "kimi-for-coding/kimi-for-coding",
+        resolve: "kimi-code-plan-cn/kimi-for-coding",
         // models.dev published this ladder on 2026-09-14; the catalog gate
         // mirrors it, so main was red until the alias carried it too.
         effort: ["low", "high", "max"]
@@ -14688,7 +14698,7 @@ var providers = {
       "kimi-k2-highspeed": {
         displayName: "Kimi K2 HighSpeed",
         description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
-        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+        resolve: "kimi-code-plan-cn/kimi-for-coding-highspeed"
       }
     }
   }),
@@ -14922,17 +14932,21 @@ var providers = {
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
-        resolve: "opencode/gpt-5-nano",
-        effort: ["minimal", "low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/gpt-5-nano"
+        resolve: "opencode/gpt-5.4-nano",
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/openai/gpt-5.4-nano"
       },
       // Zen's PAID Muse Spark, priced like Meta's own Standard tier. answered
       // `OK` through the harness on 2026-09-12 once the workspace was funded.
       "muse-spark": {
         displayName: "Muse Spark",
         resolve: "opencode/muse-spark-1.3",
-        effort: ["minimal", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/meta/muse-spark-1.3"
+        // models.dev dropped `max` from Zen's ladder on 2026-09-19 while the
+        // OpenRouter and direct `meta/` routes kept it; the catalog gate
+        // mirrors what is published per route.
+        effort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/meta/muse-spark-1.3",
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh", "max"]
       },
       // Zen's FREE contributor tier: the same model at $0 because Meta trains
       // on the prompts and completions. Zen served it to our key on 2026-09-12
@@ -14947,6 +14961,22 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
+      // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
+      // prompts and completions may be retained, not trained on.
+      "union-alpha": {
+        displayName: "Union Alpha",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/union-alpha",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true,
+        // Zen dropped the id from `/v1/models` on 2026-09-18, two days after it
+        // listed it, and answers a 500 for it. a stealth preview has no same-
+        // family successor, so stored picks land on the other free stealth
+        // model, as `minimax-m2.5-free` does.
+        fallback: "opencode/big-pickle"
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {

package/dist/utils/runErrorRenderer.d.ts

@@ -31,6 +31,11 @@
  *      provider declines to route it on this account's plan (OpenCode Zen's
  *      own refusal string). Same "pick another model" CTA, different reason.
  *
+ *   4a'. Zen free-tier gate (#1377) — Zen 403s a free-tier request whose tool
+ *      list is missing a built-in it expects. The harness keeps `bash` listed,
+ *      but opencode's auto-compaction request carries no tools, so a long
+ *      free-Zen run can still die mid-flight on the raw upstream string.
+ *
  *   4b. Context-window overflow (#1116) — terminal `Prompt is too long` /
  *      `maximum context length is N tokens`. Actionable, so it renders on
  *      both surfaces rather than collapsing to the one-line comment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.80",
+  "version": "0.1.82",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {