pullfrog 0.1.81 → 0.1.83

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.81",
+  version: "0.1.83",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -25,6 +25,7 @@ var package_default = {
     typecheck: "tsc --noEmit",
     build: "node esbuild.config.js && tsc -p tsconfig.exports.json",
     "check:entrypoints": "nub scripts/check-entrypoint-imports.ts",
+    "check:secret-commands": "nub scripts/check-secret-commands.ts",
     docker: "nub docker.ts",
     play: "nub play.ts",
     runtest: "nub test/run.ts",
@@ -35,7 +36,7 @@ var package_default = {
   },
   devDependencies: {
     "@actions/core": "^1.11.1",
-    "@anthropic-ai/claude-code": "2.1.150",
+    "@anthropic-ai/claude-code": "2.1.280",
     "@ark/fs": "0.56.0",
     "@ark/util": "0.56.0",
     "@clack/prompts": "^1.2.0",
@@ -14339,19 +14340,19 @@ var providers = {
       // API is the source of truth (#959).
       "claude-fable": {
         displayName: "Claude Fable",
-        resolve: "anthropic/claude-fable-5",
+        resolve: "anthropic/claude-fable-5-1",
         effort: ["low", "medium", "high", "xhigh", "max"],
         // rolling alias: models.dev's OpenRouter mirror lags brand-new pinned
-        // versions (claude-fable-5 isn't indexed yet), so track ~…-latest to
+        // versions (claude-fable-5 was missing there when this was added), so track ~…-latest to
         // stay catalog-valid and auto-follow version bumps.
         openRouterResolve: "openrouter/~anthropic/claude-fable-latest",
         subagentModel: "claude-sonnet"
       },
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "anthropic/claude-opus-5",
+        resolve: "anthropic/claude-opus-5-5",
         effort: ["low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/anthropic/claude-opus-5",
+        openRouterResolve: "openrouter/anthropic/claude-opus-5.5",
         preferred: true,
         subagentModel: "claude-sonnet"
       },
@@ -14386,9 +14387,9 @@ var providers = {
       },
       "gpt-sol": {
         displayName: "GPT Sol",
-        resolve: "openai/gpt-5.6-sol",
+        resolve: "openai/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-6-sol",
         preferred: true,
         subagentModel: "gpt-terra"
       },
@@ -14398,9 +14399,9 @@ var providers = {
       "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
-        resolve: "openai/gpt-5.6-sol",
+        resolve: "openai/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        openRouterResolve: "openrouter/openai/gpt-6-sol-pro",
         subagentModel: "gpt-sol"
       },
       // gpt-5.6's balanced mid-tier. selectable on its own and doubles as Sol's
@@ -14413,9 +14414,9 @@ var providers = {
       },
       "gpt-luna": {
         displayName: "GPT Luna",
-        resolve: "openai/gpt-5.6-luna",
+        resolve: "openai/gpt-6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
+        openRouterResolve: "openrouter/openai/gpt-6-luna"
       },
       // legacy aliases — openai unified the codex line into the main GPT family
       // and is shutting down every "-codex" snapshot on 2026-07-23. transparently
@@ -14509,9 +14510,9 @@ var providers = {
     models: {
       grok: {
         displayName: "Grok",
-        resolve: "xai/grok-4.6",
+        resolve: "xai/grok-4.7",
         effort: ["low", "medium", "high", "xhigh"],
-        openRouterResolve: "openrouter/x-ai/grok-4.6",
+        openRouterResolve: "openrouter/x-ai/grok-4.7",
         preferred: true
       },
       // the Smart ladder's cheap rung: 1.25/2.5 against 4.6's 2/6, and a 0.2
@@ -14526,17 +14527,17 @@ var providers = {
       // 2026-05-15 (https://docs.x.ai/developers/migration/may-15-deprecation)
       // and now redirects every deprecated text-model slug to grok-4.3 at
       // standard pricing. fall back to the live `xai/grok` so the alias
-      // chain resolves to grok-4.6 for both direct-key and OpenRouter users.
+      // chain resolves to grok-4.7 for both direct-key and OpenRouter users.
       "grok-fast": {
         displayName: "Grok Fast",
         resolve: "xai/grok-4-1-fast",
-        openRouterResolve: "openrouter/x-ai/grok-4.6",
+        openRouterResolve: "openrouter/x-ai/grok-4.7",
         fallback: "xai/grok"
       },
       "grok-code-fast": {
         displayName: "Grok Code Fast",
         resolve: "xai/grok-code-fast-1",
-        openRouterResolve: "openrouter/x-ai/grok-4.6",
+        openRouterResolve: "openrouter/x-ai/grok-4.7",
         fallback: "xai/grok"
       }
     }
@@ -14564,8 +14565,9 @@ var providers = {
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "deepseek/deepseek-v4-pro",
-        effort: ["high", "max"],
-        openRouterEffort: ["low", "high", "max"],
+        // models.dev gave the direct id V4.1-Flash's ladder on 2026-09-21, which
+        // is what DeepSeek now serves under it — and the same as the Router pin's.
+        effort: ["low", "high", "max"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813",
         preferred: true
       },
@@ -14629,12 +14631,20 @@ var providers = {
   // the same models as `moonshotai` above, billed against a Kimi membership
   // instead of a Moonshot API balance — a separate endpoint, separate model
   // ids and a separate key, which is why it is a provider rather than a second
-  // `envVars` entry. no provider injection is needed: models.dev carries
-  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
-  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `envVars` entry. no provider injection is needed: models.dev carries the
+  // provider (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/openai-compatible`) and opencode's env loop enables it from a bare
   // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
   // ids list in `opencode models` and a run reaches Kimi's own auth check.
   //
+  // models.dev renamed that provider on 2026-09-18: `kimi-for-coding` became
+  // `kimi-code-plan-cn` (api.kimi.com — where the console mints the key) and
+  // `kimi-code-plan-global` (api.kimi.ai). opencode resolves providers from
+  // its models.dev cache, so a `resolve` still spelling the old key names a
+  // provider it does not know. the `resolve` targets track models.dev's key;
+  // the provider KEY below is Pullfrog's slug and stays put. see
+  // wiki/kimi-code.md.
+  //
   // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
   // membership, so a Router path here would silently bill the wallet for
   // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
@@ -14644,9 +14654,11 @@ var providers = {
   // keyless Router pick to the default subsidy model with `noRouterPath`.
   "kimi-for-coding": provider({
     // "Kimi Code" is the product name on kimi.com/code and in the console the
-    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
-    // is models.dev's id, so it is what `enabled_providers` and every
-    // `resolve` prefix must spell.
+    // key is minted from. the provider KEY stays `kimi-for-coding`: it is the
+    // slug prefix every stored pick, `--model` flag and BYOK card spells, and
+    // it is not what reaches opencode — `enabled_providers` is derived from
+    // the `resolve` prefix (`action/agents/opencode.ts`), which is why the
+    // two may differ here and nowhere else in this file.
     displayName: "Kimi Code",
     envVars: ["KIMI_API_KEY"],
     models: {
@@ -14657,7 +14669,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
-        resolve: "kimi-for-coding/k3",
+        resolve: "kimi-code-plan-cn/k3",
         effort: ["low", "high", "max"],
         subagentModel: "kimi-k2"
       },
@@ -14672,7 +14684,7 @@ var providers = {
       "kimi-k3-256k": {
         displayName: "Kimi K3 256K",
         description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
-        resolve: "kimi-for-coding/k3-256k",
+        resolve: "kimi-code-plan-cn/k3-256k",
         effort: ["low", "high", "max"],
         preferred: true,
         subagentModel: "kimi-k2"
@@ -14680,7 +14692,7 @@ var providers = {
       "kimi-k2": {
         displayName: "Kimi K2",
         description: "Included in every Kimi membership tier",
-        resolve: "kimi-for-coding/kimi-for-coding",
+        resolve: "kimi-code-plan-cn/kimi-for-coding",
         // models.dev published this ladder on 2026-09-14; the catalog gate
         // mirrors it, so main was red until the alias carried it too.
         effort: ["low", "high", "max"]
@@ -14688,7 +14700,7 @@ var providers = {
       "kimi-k2-highspeed": {
         displayName: "Kimi K2 HighSpeed",
         description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
-        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+        resolve: "kimi-code-plan-cn/kimi-for-coding-highspeed"
       }
     }
   }),
@@ -14753,24 +14765,15 @@ var providers = {
       },
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "opencode/claude-opus-5",
+        resolve: "opencode/claude-opus-5-5",
         effort: ["low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/anthropic/claude-opus-5",
-        subagentModel: "claude-sonnet",
-        // TEMPORARY — clear this ONLY when opus completes a run through opencode,
-        // never when the endpoint merely answers. Zen LISTS claude-opus-5 in
-        // /zen/v1/models, so the catalog test passes; on 2026-08-25 the endpoint
-        // itself answered 503 `Upstream request failed: Endpoint is unavailable.`
-        // (measured 5/5; claude-sonnet-5, claude-opus-4-8, claude-haiku-4-5 and
-        // claude-fable-5 all 200 on the same key). opencode retries above the AI
-        // SDK emitting no part.updated, so a run just produces nothing until it is
-        // killed — metaideas/init logged six zero-output failures from 2026-08-23.
-        // The 503 has since cleared and the model is STILL unusable: re-measured
-        // 2026-08-26, direct POST /zen/v1/messages is 10/10 200 at 1.3-4.1s while
-        // `opencode run --model opencode/claude-opus-5` on the same trivial prompt
-        // emitted nothing for 240s in CI. A raw-endpoint 200 is not runtime
-        // availability. see wiki/opencode-silent-stall.md
-        fallback: "opencode/claude-sonnet"
+        openRouterResolve: "openrouter/anthropic/claude-opus-5.5",
+        subagentModel: "claude-sonnet"
+        // fell back to Sonnet from 2026-08-25 to 2026-09-25: Zen listed
+        // claude-opus-5 while `opencode run` on it emitted nothing for 240s. A
+        // raw-endpoint 200 is not runtime availability — the fallback was cleared
+        // only once `opencode run` completed on both claude-opus-5 and 5-5. see
+        // wiki/opencode-silent-stall.md
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
@@ -14785,9 +14788,9 @@ var providers = {
       },
       "gpt-sol": {
         displayName: "GPT Sol",
-        resolve: "opencode/gpt-5.6-sol",
+        resolve: "opencode/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-6-sol",
         subagentModel: "gpt-terra"
       },
       "gpt-astra": {
@@ -14801,9 +14804,9 @@ var providers = {
       "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
-        resolve: "opencode/gpt-5.6-sol",
+        resolve: "opencode/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        openRouterResolve: "openrouter/openai/gpt-6-sol-pro",
         subagentModel: "gpt-sol"
       },
       // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
@@ -14815,9 +14818,9 @@ var providers = {
       },
       "gpt-luna": {
         displayName: "GPT Luna",
-        resolve: "opencode/gpt-5.6-luna",
+        resolve: "opencode/gpt-6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
+        openRouterResolve: "openrouter/openai/gpt-6-luna"
       },
       // legacy aliases — see openai provider above for context.
       "gpt-codex": {
@@ -14916,9 +14919,34 @@ var providers = {
       },
       grok: {
         displayName: "Grok",
-        resolve: "opencode/grok-4.6",
+        resolve: "opencode/grok-4.7",
         effort: ["low", "medium", "high", "xhigh"],
-        openRouterResolve: "openrouter/x-ai/grok-4.6"
+        openRouterResolve: "openrouter/x-ai/grok-4.7"
+      },
+      // Zen began listing Qwen's Max and Flash tiers in late 2026-09 (Max on
+      // 09-25); until then `opencode-go` was the only Qwen route, so a Zen
+      // subscriber without Go had none. Plus is still Go-only. Zen's Max entry
+      // publishes a reasoning toggle but no effort rungs.
+      "qwen-max": {
+        displayName: "Qwen Max",
+        resolve: "opencode/qwen3.8-max",
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/qwen/qwen3.8-max-0902",
+        // unlisted until a published `pullfrog` carries this alias (the
+        // merge-vs-publish rule in wiki/models-catalog.md). unhide in the release
+        // that ships it.
+        hidden: true
+      },
+      "qwen-flash": {
+        displayName: "Qwen Flash",
+        resolve: "opencode/qwen3.8-flash",
+        effort: ["low", "medium", "xhigh"],
+        openRouterEffort: [],
+        openRouterResolve: "openrouter/qwen/qwen3.8-flash",
+        // unlisted until a published `pullfrog` carries this alias (the
+        // merge-vs-publish rule in wiki/models-catalog.md). unhide in the release
+        // that ships it.
+        hidden: true
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
@@ -14931,8 +14959,12 @@ var providers = {
       "muse-spark": {
         displayName: "Muse Spark",
         resolve: "opencode/muse-spark-1.3",
-        effort: ["minimal", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/meta/muse-spark-1.3"
+        // models.dev dropped `max` from Zen's ladder on 2026-09-19 while the
+        // OpenRouter and direct `meta/` routes kept it; the catalog gate
+        // mirrors what is published per route.
+        effort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/meta/muse-spark-1.3",
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh", "max"]
       },
       // Zen's FREE contributor tier: the same model at $0 because Meta trains
       // on the prompts and completions. Zen served it to our key on 2026-09-12
@@ -14956,13 +14988,38 @@ var providers = {
         resolve: "opencode/union-alpha",
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
-        isFree: true
+        isFree: true,
+        // Zen dropped the id from `/v1/models` on 2026-09-18, two days after it
+        // listed it, and answers a 500 for it. a stealth preview has no same-
+        // family successor, so stored picks land on the other free stealth
+        // model, as `minimax-m2.5-free` does.
+        fallback: "opencode/big-pickle"
+      },
+      // Zen's FREE stealth preview (listed 2026-09-23), the third after
+      // big-pickle and union-alpha. OpenRouter's listing: prompts and
+      // completions may be retained by the provider, not trained on. unlike the
+      // first two it publishes an effort ladder, so the gate mirrors one here.
+      "space-bunny": {
+        displayName: "Space Bunny",
+        description: "Stealth preview; prompts may be retained",
+        resolve: "opencode/space-bunny-free",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true,
+        // unlisted until a published `pullfrog` carries this alias: 0.1.82
+        // predates it, so a run passes `opencode/space-bunny` through raw and
+        // Zen answers a 500. unhide in the release that ships it.
+        hidden: true
       },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
         displayName: "MiMo",
-        resolve: "opencode/mimo-v2.5-free",
+        // models.dev deprecated `mimo-v2.5-free` on 2026-09-22. V2.6-Flash is
+        // the only other MiMo Zen serves, so the slug follows it across the
+        // tier rather than leaving stored picks on a dying id.
+        resolve: "opencode/mimo-v2.6-flash-free",
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
         isFree: true
@@ -14991,11 +15048,12 @@ var providers = {
   // OpenCode Go is a separate $10/mo subscription from Zen, served on its own
   // base URL (`https://opencode.ai/zen/go/v1`) but authenticated with the SAME
   // `OPENCODE_API_KEY`. it carries the open-weight coding models plus a couple
-  // of frontier ones, six of which are served ONLY here — Zen's `/v1/models`
-  // does not list qwen3.7/3.8-*, mimo-v2.5-pro, longcat-2.0 or hy3. (it listed
+  // of frontier ones, four of which are served ONLY here — Zen's `/v1/models`
+  // does not list qwen3.7-plus, mimo-v2.6-pro, longcat-2.0 or hy3. (it listed
   // no glm-5.3* either until 2026-09, which is why `opencode/glm` trailed on
-  // 5.2.) so for a Go subscriber this provider is not a duplicate route to Zen,
-  // it is the only route to a large part of what they pay for.
+  // 5.2, and no qwen3.8-* until late 2026-09.) so for a Go subscriber this
+  // provider is not a duplicate route to Zen, it is the only route to a large
+  // part of what they pay for.
   // like `opencode` and `openrouter` this is a ROUTER, not a vendor: slugs and
   // display names mirror the upstream brand tier, and the picker groups them
   // under the upstream vendor.
@@ -15055,7 +15113,8 @@ var providers = {
       // picker row that fails for almost everyone is worse than none. DeepSeek
       // stays reachable ungated via `deepseek/*`, `opencode/*` and
       // `openrouter/*`; both remain runnable by full specifier once opted in.
-      // Alibaba — new vendor family for the catalog; Zen serves neither tier.
+      // Alibaba — Zen serves Max and Flash too (see `opencode/qwen-max`); Plus
+      // is Go-only.
       "qwen-max": {
         displayName: "Qwen Max",
         resolve: "opencode-go/qwen3.8-max",
@@ -15098,8 +15157,8 @@ var providers = {
       // Xiaomi — Go-only; Zen serves the free `mimo-v2-pro-free` promo instead.
       "mimo-pro": {
         displayName: "MiMo Pro",
-        resolve: "opencode-go/mimo-v2.5-pro",
-        openRouterResolve: "openrouter/xiaomi/mimo-v2.5-pro"
+        resolve: "opencode-go/mimo-v2.6-pro",
+        openRouterResolve: "openrouter/xiaomi/mimo-v2.6-pro"
       },
       // Meituan — Go-only.
       longcat: {
@@ -15125,15 +15184,15 @@ var providers = {
       // wiki/models-catalog.md on `opencode/kimi-k2`.
       grok: {
         displayName: "Grok",
-        resolve: "opencode-go/grok-4.6",
+        resolve: "opencode-go/grok-4.7",
         effort: ["low", "medium", "high", "xhigh"],
-        openRouterResolve: "openrouter/x-ai/grok-4.6"
+        openRouterResolve: "openrouter/x-ai/grok-4.7"
       },
       "gpt-luna": {
         displayName: "GPT Luna",
-        resolve: "opencode-go/gpt-5.6-luna",
+        resolve: "opencode-go/gpt-6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
+        openRouterResolve: "openrouter/openai/gpt-6-luna"
       }
     }
   }),
@@ -15235,15 +15294,15 @@ var providers = {
         resolve: "openrouter/~anthropic/claude-haiku-latest",
         openRouterResolve: "openrouter/~anthropic/claude-haiku-latest"
       },
-      // pinned to the explicit gpt-5.6 tiers (not the ~openai/gpt-latest rolling
-      // alias): after the Sol/Terra/Luna rename, ~gpt-mini-latest no longer maps
+      // pinned to the explicit Sol/Terra/Luna tiers (not the ~openai/gpt-latest
+      // rolling alias): after that rename, ~gpt-mini-latest no longer maps
       // to Luna, so rolling aliases would silently diverge `gpt`/`gpt-mini` from
       // the chosen tiers across funding paths.
       "gpt-sol": {
         displayName: "GPT Sol",
-        resolve: "openrouter/openai/gpt-5.6-sol",
+        resolve: "openrouter/openai/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol",
+        openRouterResolve: "openrouter/openai/gpt-6-sol",
         subagentModel: "gpt-terra"
       },
       "gpt-astra": {
@@ -15257,9 +15316,9 @@ var providers = {
       "gpt-sol-pro": {
         displayName: "GPT Sol Pro",
         description: "Maximum reasoning effort",
-        resolve: "openrouter/openai/gpt-5.6-sol-pro",
+        resolve: "openrouter/openai/gpt-6-sol-pro",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-sol-pro",
+        openRouterResolve: "openrouter/openai/gpt-6-sol-pro",
         subagentModel: "gpt-sol"
       },
       // gpt-5.6 balanced mid-tier — selectable + Sol's subagent. see openai above.
@@ -15271,9 +15330,9 @@ var providers = {
       },
       "gpt-luna": {
         displayName: "GPT Luna",
-        resolve: "openrouter/openai/gpt-5.6-luna",
+        resolve: "openrouter/openai/gpt-6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
-        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
+        openRouterResolve: "openrouter/openai/gpt-6-luna"
       },
       // legacy aliases — see openai provider for context.
       "gpt-codex": {
@@ -15337,9 +15396,9 @@ var providers = {
       },
       grok: {
         displayName: "Grok",
-        resolve: "openrouter/x-ai/grok-4.6",
+        resolve: "openrouter/x-ai/grok-4.7",
         effort: ["low", "medium", "high", "xhigh"],
-        openRouterResolve: "openrouter/x-ai/grok-4.6"
+        openRouterResolve: "openrouter/x-ai/grok-4.7"
       },
       // dated pin, not the bare id — see `deepseek/deepseek-pro` for why
       // OpenRouter's unversioned `deepseek-v4-pro` is the stale April preview.
@@ -15410,8 +15469,10 @@ var providers = {
   vercel: provider({
     // Vercel AI Gateway — one key serves every model it fronts. model IDs use
     // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
-    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
-    // catalog's entries, not the upstream vendor's. deliberately no
+    // `anthropic/claude-opus-5.5`, `zai/glm-5.3`). effort ladders come from the
+    // gateway's OWN `/v1/models`, not models.dev — the two disagree routinely
+    // (on 2026-09-22 they disagreed on all ten entries that drifted), and the
+    // drift test reads the gateway for that reason. deliberately no
     // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
     // over the Router proxy would bill the wallet for traffic the user pointed
     // at their own gateway.
@@ -15420,7 +15481,7 @@ var providers = {
     models: {
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "vercel/anthropic/claude-opus-5",
+        resolve: "vercel/anthropic/claude-opus-5.5",
         effort: ["low", "medium", "high", "xhigh", "max"],
         preferred: true,
         subagentModel: "claude-sonnet"
@@ -15428,7 +15489,7 @@ var providers = {
       "claude-sonnet": {
         displayName: "Claude Sonnet",
         resolve: "vercel/anthropic/claude-sonnet-5",
-        effort: ["low", "medium", "high", "xhigh"]
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
@@ -15436,7 +15497,7 @@ var providers = {
       },
       "gpt-sol": {
         displayName: "GPT Sol",
-        resolve: "vercel/openai/gpt-5.6-sol",
+        resolve: "vercel/openai/gpt-6-sol",
         effort: ["none", "low", "medium", "high", "xhigh", "max"],
         subagentModel: "gpt-terra"
       },
@@ -15449,35 +15510,35 @@ var providers = {
       "gpt-terra": {
         displayName: "GPT Terra",
         resolve: "vercel/openai/gpt-5.6-terra",
-        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+        effort: ["none", "minimal", "low", "medium", "high", "xhigh", "max"]
       },
       "gpt-luna": {
         displayName: "GPT Luna",
-        resolve: "vercel/openai/gpt-5.6-luna",
+        resolve: "vercel/openai/gpt-6-luna",
         effort: ["none", "low", "medium", "high", "xhigh", "max"]
       },
       "gemini-pro": {
         displayName: "Gemini Pro",
         resolve: "vercel/google/gemini-3.1-pro-preview",
-        effort: ["low", "medium", "high"]
+        effort: ["low", "high"]
       },
       "gemini-flash": {
         displayName: "Gemini Flash",
         resolve: "vercel/google/gemini-3.8-flash",
-        effort: ["low", "medium", "high"]
+        effort: ["low", "high"]
       },
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "vercel/deepseek/deepseek-v4-pro-0813",
-        effort: ["high", "xhigh"]
+        effort: ["none", "high", "max"]
       },
       // the gateway's bare `deepseek-v4-flash` is the April preview — the same
       // fork trap as OpenRouter, with `deepseek-v4-flash-0731` beside it — so
-      // this entry sat on the preview until V4.1. the gateway publishes no
-      // effort ladder for the V4.1 id.
+      // this entry sat on the preview until V4.1.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
-        resolve: "vercel/deepseek/deepseek-v4.1-flash"
+        resolve: "vercel/deepseek/deepseek-v4.1-flash",
+        effort: ["none", "high", "max"]
       },
       glm: {
         displayName: "GLM",
@@ -15487,12 +15548,12 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         resolve: "vercel/moonshotai/kimi-k3",
-        effort: ["low", "high", "max"]
+        effort: ["none", "low", "high", "max"]
       },
-      // the gateway publishes no effort ladder for this id.
       "muse-spark": {
         displayName: "Muse Spark",
-        resolve: "vercel/meta/muse-spark-1.3"
+        resolve: "vercel/meta/muse-spark-1.3",
+        effort: ["minimal", "low", "medium", "high", "xhigh"]
       }
     }
   })

package/dist/mcp/searchIssues.d.ts

@@ -0,0 +1,8 @@
+import type { ToolContext } from "./server.ts";
+export declare function SearchIssuesTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    terms: string[];
+}, {
+    terms: string[];
+}>> & {
+    mutates?: boolean;
+};

package/dist/mcp/server.d.ts

@@ -23,6 +23,7 @@ export interface ToolContext {
     postCheckoutScript: string | null;
     prepushScript: string | null;
     prApproveEnabled: boolean;
+    reviewDrafts: boolean;
     autoMergeEnabled: boolean;
     signedCommits: boolean;
     repoIntelligence: boolean;

package/dist/utils/normalizeEnv.d.ts

@@ -5,7 +5,7 @@
  * that re-emits parts of it leaks the unmasked tail. Trimming canonicalises
  * the value so the mask matches exactly what downstream tools will print.
  *
- * Masking is delegated to `core.setSecret` (not raw `console.log`) so the
+ * Masking is delegated to `maskSecret` (not raw `console.log`) so the
  * toolkit percent-encodes `\r`/`\n`; the runner V2 parser decodes them and
  * registers the full value plus every non-empty line as separate masks. That
  * keeps us safe for embedded-newline values (PEMs, kubeconfigs, JSON blobs)

package/dist/utils/overrides.d.ts

@@ -27,7 +27,7 @@ export declare function parseOverrides(raw: string): Record<string, string>;
 /**
  * Mutate `params.env` in place with the supplied JSON overrides, skipping any
  * names in `DENIED_OVERRIDE_NAMES`. Each applied value is registered with
- * `core.setSecret` so the runner masks it in subsequent log output, and the
+ * `maskSecret` so the runner masks it in subsequent log output, and the
  * raw `UNSAFE_OVERRIDES` env var is deleted so spawned subprocesses don't
  * inherit the original JSON (which would defeat both the deny-list and the
  * masking by exposing the values verbatim).

package/dist/utils/runContext.d.ts

@@ -34,6 +34,7 @@ export interface RepoSettings {
     push: PushPermission;
     shell: ShellPermission;
     prApproveEnabled: boolean;
+    reviewDrafts: boolean;
     autoMergeEnabled: boolean;
     codexAgent: boolean;
     signedCommits: boolean;

package/dist/utils/runErrorRenderer.d.ts

@@ -31,6 +31,11 @@
  *      provider declines to route it on this account's plan (OpenCode Zen's
  *      own refusal string). Same "pick another model" CTA, different reason.
  *
+ *   4a'. Zen free-tier gate (#1377) — Zen 403s a free-tier request whose tool
+ *      list is missing a built-in it expects. The harness keeps `bash` listed,
+ *      but opencode's auto-compaction request carries no tools, so a long
+ *      free-Zen run can still die mid-flight on the raw upstream string.
+ *
  *   4b. Context-window overflow (#1116) — terminal `Prompt is too long` /
  *      `maximum context length is N tokens`. Actionable, so it renders on
  *      both surfaces rather than collapsing to the one-line comment.