pullfrog 0.1.85 → 0.1.86

package/dist/cli.mjs

@@ -84177,7 +84177,7 @@ var require_Element = __commonJS({
     var FilteredElementList = require_FilteredElementList();
     var DOMException2 = require_DOMException();
     var DOMTokenList = require_DOMTokenList();
-    var select3 = require_select();
+    var select2 = require_select();
     var ContainerNode = require_ContainerNode();
     var ChildNode = require_ChildNode();
     var NonDocumentTypeChildNode = require_NonDocumentTypeChildNode();
@@ -84938,7 +84938,7 @@ var require_Element = __commonJS({
         this.className = v;
       } },
       matches: { value: function(selector) {
-        return select3.matches(this, selector);
+        return select2.matches(this, selector);
       } },
       closest: { value: function(selector) {
         var el = this;
@@ -84951,10 +84951,10 @@ var require_Element = __commonJS({
         return null;
       } },
       querySelector: { value: function(selector) {
-        return select3(selector, this)[0];
+        return select2(selector, this)[0];
       } },
       querySelectorAll: { value: function(selector) {
-        var nodes = select3(selector, this);
+        var nodes = select2(selector, this);
         return nodes.item ? nodes : new NodeList(nodes);
       } }
     });
@@ -85482,7 +85482,7 @@ var require_DocumentFragment = __commonJS({
     var NodeList = require_NodeList();
     var ContainerNode = require_ContainerNode();
     var Element = require_Element();
-    var select3 = require_select();
+    var select2 = require_select();
     var utils = require_utils8();
     function DocumentFragment(doc) {
       ContainerNode.call(this);
@@ -85511,7 +85511,7 @@ var require_DocumentFragment = __commonJS({
         context.isHTML = true;
         context.getElementsByTagName = Element.prototype.getElementsByTagName;
         context.nextElement = Object.getOwnPropertyDescriptor(Element.prototype, "firstElementChild").get;
-        var nodes = select3(selector, context);
+        var nodes = select2(selector, context);
         return nodes.item ? nodes : new NodeList(nodes);
       } },
       // Utility methods
@@ -88626,7 +88626,7 @@ var require_Document = __commonJS({
     var NodeIterator = require_NodeIterator();
     var NodeFilter = require_NodeFilter();
     var URL2 = require_URL();
-    var select3 = require_select();
+    var select2 = require_select();
     var events = require_events3();
     var xml = require_xmlnames();
     var html = require_htmlelts();
@@ -89187,10 +89187,10 @@ var require_Document = __commonJS({
         return this._templateDocCache;
       } },
       querySelector: { value: function(selector) {
-        return select3(selector, this)[0];
+        return select2(selector, this)[0];
       } },
       querySelectorAll: { value: function(selector) {
-        var nodes = select3(selector, this);
+        var nodes = select2(selector, this);
         return nodes.item ? nodes : new NodeList(nodes);
       } }
     });
@@ -107103,7 +107103,7 @@ var import_picocolors = __toESM(require_picocolors(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.85",
+  version: "0.1.86",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -110310,8 +110310,8 @@ var providers = {
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
-        resolve: "vercel/anthropic/claude-sonnet-5",
-        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+        resolve: "vercel/anthropic/claude-sonnet-5.5",
+        effort: ["low", "medium", "high", "xhigh", "max"]
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
@@ -113518,17 +113518,6 @@ import { join as join6 } from "node:path";
 var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
 var XAI_AUTH_ENV = "GROK_AUTH_JSON";
 var installedSubscriptionPaths = /* @__PURE__ */ new Map();
-function clearInstalledSubscription(name) {
-  const path4 = installedSubscriptionPaths.get(name);
-  if (!path4 || !existsSync5(path4)) return;
-  const value2 = JSON.parse(readFileSync3(path4, "utf8"));
-  if (!value2 || typeof value2 !== "object") return;
-  if (name === "CODEX_AUTH_JSON" && "openai" in value2) delete value2.openai;
-  if (name === "GROK_AUTH_JSON" && "xai" in value2) delete value2.xai;
-  writeFileSync5(path4, `${JSON.stringify(value2)}
-`, { mode: 384 });
-  installedSubscriptionPaths.delete(name);
-}
 var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
 function isRejectedChain(body) {
   if (!body.refresh_rejected_at) return false;
@@ -113859,8 +113848,8 @@ async function writeBackEntry(apiToken, entry) {
   }
   try {
     const poolState = core2.getState("credential_receipts");
-    const receipts2 = external_exports.record(external_exports.string(), external_exports.string()).parse(JSON.parse(poolState || "{}"));
-    const receipt = receipts2[entry.secretName];
+    const receipts = external_exports.record(external_exports.string(), external_exports.string()).parse(JSON.parse(poolState || "{}"));
+    const receipt = receipts[entry.secretName];
     if (poolState && !receipt) return;
     const response = await apiFetch({
       path: receipt ? "/api/runtime/credentials" : "/api/runtime/secret",
@@ -198136,304 +198125,6 @@ async function checkConfiguredCredentials(params) {
   return replacement ? { kind: "fellBack", ...outcome, replacement } : { kind: "dead", ...outcome };
 }
 
-// utils/normalizeEnv.ts
-function hasControlCharacter(value2) {
-  return [...value2].some((ch) => {
-    const code = ch.charCodeAt(0);
-    return code < 32 || code === 127;
-  });
-}
-function sanitizeSecret(key, value2) {
-  const trimmed = value2.trim();
-  if (trimmed.length === 0) {
-    log2.warning(
-      `\xBB ${key} is whitespace-only \u2014 leaving env var unchanged. check your secret value.`
-    );
-    return null;
-  }
-  if (key.endsWith("_API_KEY") && hasControlCharacter(trimmed)) {
-    log2.warning(
-      `\xBB ${key} contains a line break or control character and cannot be sent as an HTTP header \u2014 leaving env var unchanged. re-save the secret as a single line.`
-    );
-    return null;
-  }
-  if (trimmed !== value2) {
-    log2.warning(
-      `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
-    );
-  }
-  maskSecret(trimmed);
-  return trimmed;
-}
-function normalizeEnv() {
-  const upperKeys = /* @__PURE__ */ new Map();
-  for (const key of Object.keys(process.env)) {
-    const upper2 = key.toUpperCase();
-    const existing = upperKeys.get(upper2) || [];
-    existing.push(key);
-    upperKeys.set(upper2, existing);
-  }
-  for (const [upperKey, keys] of upperKeys) {
-    if (keys.length === 1) {
-      const key = keys[0];
-      if (key !== upperKey) {
-        process.env[upperKey] = process.env[key];
-        delete process.env[key];
-      }
-      continue;
-    }
-    const values = keys.map((k2) => process.env[k2]);
-    const uniqueValues = new Set(values);
-    if (uniqueValues.size > 1) {
-      log2.warning(
-        `env var conflict: ${keys.join(", ")} have different values. using uppercase ${upperKey}.`
-      );
-    }
-    const preferredKey = keys.find((k2) => k2 === upperKey) || keys[0];
-    const preferredValue = process.env[preferredKey];
-    for (const key of keys) {
-      delete process.env[key];
-    }
-    process.env[upperKey] = preferredValue;
-  }
-  for (const key of Object.keys(process.env)) {
-    if (!isSensitiveEnvName(key)) continue;
-    const value2 = process.env[key];
-    if (typeof value2 !== "string" || value2.length === 0) continue;
-    const sanitized = sanitizeSecret(key, value2);
-    if (sanitized !== null) process.env[key] = sanitized;
-  }
-}
-
-// utils/subscriptionProbe.ts
-var identitySchema = external_exports.object({
-  email: external_exports.string().email().optional(),
-  sub: external_exports.string().optional(),
-  user_id: external_exports.string().optional(),
-  account_id: external_exports.string().optional(),
-  email_verified: external_exports.boolean().optional()
-});
-var codexUsageSchema = external_exports.object({
-  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
-});
-async function readSubscriptionEndpoint(input) {
-  const headers = new Headers({ authorization: `Bearer ${input.token}` });
-  if (input.accountId) headers.set("ChatGPT-Account-Id", input.accountId);
-  if (input.grokBilling) headers.set("x-xai-token-auth", "xai-grok-cli");
-  return fetch(input.url, {
-    headers,
-    redirect: "error",
-    signal: AbortSignal.timeout(1e4)
-  }).catch(() => null);
-}
-async function probeSubscription(input) {
-  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
-    const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
-    return result.usable ? "usable" : "rejected";
-  }
-  const codex2 = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
-  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
-  const auth2 = codex2 ?? grok;
-  if (!auth2 || auth2.refresh_rejected_at) return "rejected";
-  if (grok && input.model)
-    return probeInference({
-      name: "XAI_API_KEY",
-      value: grok.tokens.access_token,
-      model: input.model
-    });
-  const response = await readSubscriptionEndpoint({
-    url: codex2 ? "https://chatgpt.com/backend-api/wham/usage" : "https://cli-chat-proxy.grok.com/v1/billing?format=credits",
-    token: auth2.tokens.access_token,
-    accountId: codex2?.tokens.account_id,
-    grokBilling: !!grok
-  });
-  if (response?.status === 401) return "rejected";
-  if (!response?.ok) return "unknown";
-  const body = await response.json().catch(() => null);
-  if (codex2) {
-    const parsed2 = codexUsageSchema.safeParse(body);
-    const limit = parsed2.success ? parsed2.data.rate_limit : void 0;
-    if (!limit) return "unknown";
-    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
-  }
-  return "unknown";
-}
-async function probeInference(input) {
-  const anthropic = input.name === "ANTHROPIC_API_KEY";
-  const openai = input.name === "OPENAI_API_KEY";
-  if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
-    const result = await verifyCredential({ envVar: input.name, value: input.value });
-    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
-  }
-  const headers = new Headers({ "content-type": "application/json" });
-  if (anthropic) {
-    headers.set("x-api-key", input.value);
-    headers.set("anthropic-version", "2023-06-01");
-  } else headers.set("authorization", `Bearer ${input.value}`);
-  const response = await fetch(
-    anthropic ? "https://api.anthropic.com/v1/messages" : openai ? "https://api.openai.com/v1/responses" : "https://api.x.ai/v1/chat/completions",
-    {
-      method: "POST",
-      headers,
-      body: JSON.stringify(
-        openai ? { model: input.model, input: "Reply OK.", max_output_tokens: 16, store: false } : {
-          model: input.model,
-          messages: [{ role: "user", content: "Reply OK." }],
-          max_tokens: 1
-        }
-      ),
-      redirect: "error",
-      signal: AbortSignal.timeout(1e4)
-    }
-  ).catch(() => null);
-  if (response?.status === 400 && input.name === "XAI_API_KEY") {
-    const error49 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
-    return error49.success && error49.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
-  }
-  await response?.body?.cancel();
-  if (!response) return "unknown";
-  if (response.ok) return "usable";
-  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
-}
-
-// utils/credentialPool.ts
-var receipts = {};
-var workflowCredentials = {};
-function saveReceipts() {
-  for (const receipt of Object.values(receipts)) maskSecret(receipt);
-  saveSecretState("credential_receipts", JSON.stringify(receipts));
-}
-var select2 = op(
-  async (input) => {
-    const response = await apiFetch({
-      path: "/api/runtime/credentials",
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${input.access.token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ id: input.candidate.id }),
-      signal: AbortSignal.timeout(35e3)
-    });
-    if (response.status === 404) return null;
-    if (!response.ok)
-      throw new Error("could not load a configured credential; no fallback was charged", {
-        cause: response.status
-      });
-    return selectedCredentialSchema.parse(await response.json());
-  },
-  {
-    retries: [250, 1e3],
-    bail: (error49) => error49 instanceof Error && typeof error49.cause === "number" && error49.cause >= 400 && error49.cause < 500
-  }
-);
-function subscriptionForModel(model) {
-  if (!model.includes("/")) return null;
-  const provider2 = getModelProvider(model);
-  return provider2 === "anthropic" ? "CLAUDE_CODE_OAUTH_TOKEN" : provider2 === "openai" ? "CODEX_AUTH_JSON" : provider2 === "xai" ? "GROK_AUTH_JSON" : null;
-}
-async function initializeCredentialPool(ctx, model) {
-  const access = ctx.credentialAccess;
-  if (!access) return;
-  maskSecret(access.token);
-  const names = /* @__PURE__ */ new Set([
-    ...access.candidates.map((candidate) => candidate.name),
-    ...subscriptionNameSchema.options,
-    "ANTHROPIC_API_KEY",
-    "OPENAI_API_KEY",
-    "XAI_API_KEY"
-  ]);
-  for (const name of names) {
-    const value2 = process.env[name];
-    if (value2) workflowCredentials[name] = value2;
-  }
-  for (const name of subscriptionNameSchema.options) {
-    if (model && subscriptionForModel(model) !== name) continue;
-    if (workflowCredentials[name]) continue;
-    const candidate = access.candidates.find((item) => item.name === name);
-    if (!candidate) continue;
-    const selected = await select2({ access, candidate }).catch(() => {
-      log2.warning(`\xBB could not load ${name} for model discovery; selection will retry if needed`);
-      return null;
-    });
-    if (!selected) continue;
-    const value2 = sanitizeSecret(name, selected.value);
-    if (!value2) continue;
-    process.env[name] = value2;
-    receipts[name] = selected.receipt;
-  }
-  saveReceipts();
-}
-function resolvePoolModel(input) {
-  const agent2 = resolveAgent({
-    model: void 0,
-    proxyModel: void 0,
-    codexAgent: input.codexAgent
-  });
-  if (agent2.name === "opencode") return autoSelectModel();
-  const provider2 = agent2.name === "claude" ? "anthropic" : "openai";
-  return modelAliases.find(
-    (alias) => alias.provider === provider2 && alias.preferred && !alias.hidden && !alias.fallback && !alias.routing
-  )?.resolve;
-}
-async function selectConfiguredCredential(input) {
-  const access = input.ctx.credentialAccess;
-  const model = input.model;
-  if (!access || !model?.includes("/") || getProviderGatewayUrl(model)) return false;
-  const subscription = subscriptionForModel(model);
-  const names = getModelEnvVars(model).filter((name) => name !== subscription);
-  if (subscription) names.unshift(subscription);
-  const candidates = access.candidates.filter((candidate) => names.includes(candidate.name));
-  const workflow = names.filter((name) => workflowCredentials[name]);
-  if (!candidates.length && !workflow.length) return false;
-  for (const name of workflow) {
-    const value2 = workflowCredentials[name];
-    if (await usable({ name, value: value2, model })) {
-      activate({ names, name, value: value2, receipt: void 0 });
-      return true;
-    }
-  }
-  for (const candidate of candidates) {
-    const selected = await select2({ access, candidate });
-    if (!selected) continue;
-    if (await usable({ ...selected, model })) {
-      activate({ names, ...selected });
-      log2.info(`\xBB selected ${candidate.name} from ${candidate.source} scope`);
-      return true;
-    }
-    log2.info(
-      `\xBB ${candidate.name} from ${candidate.source} scope unavailable; trying the next credential`
-    );
-  }
-  throw new Error(
-    `all configured credentials for ${model} were rejected or exhausted; no other model or provider was selected`
-  );
-}
-async function usable(input) {
-  const subscription = subscriptionNameSchema.safeParse(input.name);
-  if (subscription.success)
-    return await probeSubscription({
-      name: subscription.data,
-      value: input.value,
-      model: stripProviderPrefix(input.model)
-    }) !== "rejected";
-  return await probeInference({ ...input, model: stripProviderPrefix(input.model) }) !== "rejected";
-}
-function activate(input) {
-  for (const name of input.names) {
-    delete process.env[name];
-    delete receipts[name];
-    if (name === "CODEX_AUTH_JSON" || name === "GROK_AUTH_JSON") clearInstalledSubscription(name);
-  }
-  const value2 = sanitizeSecret(input.name, input.value);
-  if (!value2) throw new Error("configured credential was empty");
-  process.env[input.name] = value2;
-  if (input.receipt) receipts[input.name] = input.receipt;
-  installCodexAuth();
-  installXaiAuth();
-  saveReceipts();
-}
-
 // utils/gitAuthServer.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync15 } from "node:fs";
@@ -199137,6 +198828,75 @@ function buildModelAccessError(input) {
   return [headline, "", why, "", cta].join("\n");
 }
 
+// utils/normalizeEnv.ts
+function hasControlCharacter(value2) {
+  return [...value2].some((ch) => {
+    const code = ch.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+}
+function sanitizeSecret(key, value2) {
+  const trimmed = value2.trim();
+  if (trimmed.length === 0) {
+    log2.warning(
+      `\xBB ${key} is whitespace-only \u2014 leaving env var unchanged. check your secret value.`
+    );
+    return null;
+  }
+  if (key.endsWith("_API_KEY") && hasControlCharacter(trimmed)) {
+    log2.warning(
+      `\xBB ${key} contains a line break or control character and cannot be sent as an HTTP header \u2014 leaving env var unchanged. re-save the secret as a single line.`
+    );
+    return null;
+  }
+  if (trimmed !== value2) {
+    log2.warning(
+      `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
+    );
+  }
+  maskSecret(trimmed);
+  return trimmed;
+}
+function normalizeEnv() {
+  const upperKeys = /* @__PURE__ */ new Map();
+  for (const key of Object.keys(process.env)) {
+    const upper2 = key.toUpperCase();
+    const existing = upperKeys.get(upper2) || [];
+    existing.push(key);
+    upperKeys.set(upper2, existing);
+  }
+  for (const [upperKey, keys] of upperKeys) {
+    if (keys.length === 1) {
+      const key = keys[0];
+      if (key !== upperKey) {
+        process.env[upperKey] = process.env[key];
+        delete process.env[key];
+      }
+      continue;
+    }
+    const values = keys.map((k2) => process.env[k2]);
+    const uniqueValues = new Set(values);
+    if (uniqueValues.size > 1) {
+      log2.warning(
+        `env var conflict: ${keys.join(", ")} have different values. using uppercase ${upperKey}.`
+      );
+    }
+    const preferredKey = keys.find((k2) => k2 === upperKey) || keys[0];
+    const preferredValue = process.env[preferredKey];
+    for (const key of keys) {
+      delete process.env[key];
+    }
+    process.env[upperKey] = preferredValue;
+  }
+  for (const key of Object.keys(process.env)) {
+    if (!isSensitiveEnvName(key)) continue;
+    const value2 = process.env[key];
+    if (typeof value2 !== "string" || value2.length === 0) continue;
+    const sanitized = sanitizeSecret(key, value2);
+    if (sanitized !== null) process.env[key] = sanitized;
+  }
+}
+
 // utils/overrides.ts
 var DENIED_OVERRIDE_NAMES = /* @__PURE__ */ new Set([
   "GITHUB_TOKEN",
@@ -200091,8 +199851,7 @@ async function fetchRunContext(params) {
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const headers = {
-      Authorization: `Bearer ${params.token}`,
-      "X-Pullfrog-Credential-Pools": "1"
+      Authorization: `Bearer ${params.token}`
     };
     if (params.oidcToken) {
       headers["X-GitHub-OIDC-Token"] = params.oidcToken;
@@ -201362,7 +201121,6 @@ async function main() {
     const preIntrospectionDirty = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
     const opencodeCliPath = await agents.opencode.install();
     captureBaselineModels(opencodeCliPath);
-    await initializeCredentialPool(runContext, resolveModel({ slug: payload.model }));
     if (runContext.dbSecrets) {
       for (const [key, value2] of Object.entries(runContext.dbSecrets)) {
         if (!process.env[key]) {
@@ -201446,27 +201204,14 @@ async function main() {
         }
         const gitAuthServer = __using(_stack2, await startGitAuthServer(tmpdir4), true);
         setGitAuthServer(gitAuthServer);
-        let configuredModel = resolveModel({ slug: payload.model });
-        if (!configuredModel && !payload.proxyModel && runContext.credentialAccess?.candidates.length) {
-          configuredModel = resolvePoolModel({
-            codexAgent: runContext.repoSettings.codexAgent || payload.codexArm === true
-          });
-        }
-        let poolSelected = !payload.proxyModel && await selectConfiguredCredential({
-          ctx: runContext,
-          model: configuredModel
-        });
         const access = decideModelAccess({
           modelExplicit: payload.modelExplicit ?? false,
           model: payload.model,
           oss: runContext.oss,
           proxyActive: !!payload.proxyModel,
           subsidyTarget: runContext.proxyModel,
-          resolvedModel: configuredModel,
-          authorized: /* @__PURE__ */ new Set([
-            ...getAuthorizedModels(),
-            ...poolSelected && configuredModel ? [configuredModel] : []
-          ])
+          resolvedModel: resolveModel({ slug: payload.model }),
+          authorized: getAuthorizedModels()
         });
         if (access.kind === "error") {
           throw new Error(
@@ -201479,25 +201224,12 @@ async function main() {
           );
         }
         if (access.kind === "proxy") payload.proxyModel = access.target;
-        if (access.kind === "byok") {
-          payload.proxyModel = void 0;
-          if (!poolSelected)
-            poolSelected = await selectConfiguredCredential({
-              ctx: runContext,
-              model: configuredModel
-            });
-        }
-        if (poolSelected) {
-          const before = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
-          captureAuthorizedModels(opencodeCliPath);
-          if (before && repoDir)
-            await restoreDirtiedSince({ before, actor: "model introspection", cwd: repoDir });
-        }
+        if (access.kind === "byok") payload.proxyModel = void 0;
         if (runContext.oss && payload.proxyModel) {
           payload.effort = ossEffortFloor({ payload });
         }
-        if (payload.proxyModel) configuredModel = void 0;
-        const credentials = payload.proxyModel || poolSelected ? { kind: "ok" } : await checkConfiguredCredentials({
+        const configuredModel = payload.proxyModel ? void 0 : resolveModel({ slug: payload.model });
+        const credentials = payload.proxyModel ? { kind: "ok" } : await checkConfiguredCredentials({
           model: configuredModel,
           authorized: getAuthorizedModels()
         });
@@ -201828,12 +201560,12 @@ ${instructions.user}` : null,
         if (payload.timeout === TIMEOUT_DISABLED) {
           result = await Promise.race([agentPromise, activityTimeout.promise]);
         } else {
-          const usable2 = resolveTimeoutMs(payload.timeout);
-          if (payload.timeout && usable2 === null) {
+          const usable = resolveTimeoutMs(payload.timeout);
+          if (payload.timeout && usable === null) {
             log2.warning(`invalid timeout "${payload.timeout}" (use --notimeout to disable), using 1h`);
           }
-          const timeoutMs = usable2 ?? 36e5;
-          const actualTimeout = usable2 !== null ? payload.timeout : "1h";
+          const timeoutMs = usable ?? 36e5;
+          const actualTimeout = usable !== null ? payload.timeout : "1h";
           let timeoutId;
           const timeoutPromise = new Promise((_4, reject) => {
             timeoutId = setTimeout(() => {
@@ -202461,7 +202193,7 @@ function resolveTarget2(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.85");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.86");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -202628,7 +202360,7 @@ async function runCli8(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.85";
+var VERSION10 = "0.1.86";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -83904,7 +83904,7 @@ var require_Element = __commonJS({
     var FilteredElementList = require_FilteredElementList();
     var DOMException2 = require_DOMException();
     var DOMTokenList = require_DOMTokenList();
-    var select2 = require_select();
+    var select = require_select();
     var ContainerNode = require_ContainerNode();
     var ChildNode = require_ChildNode();
     var NonDocumentTypeChildNode = require_NonDocumentTypeChildNode();
@@ -84665,7 +84665,7 @@ var require_Element = __commonJS({
         this.className = v;
       } },
       matches: { value: function(selector) {
-        return select2.matches(this, selector);
+        return select.matches(this, selector);
       } },
       closest: { value: function(selector) {
         var el = this;
@@ -84678,10 +84678,10 @@ var require_Element = __commonJS({
         return null;
       } },
       querySelector: { value: function(selector) {
-        return select2(selector, this)[0];
+        return select(selector, this)[0];
       } },
       querySelectorAll: { value: function(selector) {
-        var nodes = select2(selector, this);
+        var nodes = select(selector, this);
         return nodes.item ? nodes : new NodeList(nodes);
       } }
     });
@@ -85209,7 +85209,7 @@ var require_DocumentFragment = __commonJS({
     var NodeList = require_NodeList();
     var ContainerNode = require_ContainerNode();
     var Element = require_Element();
-    var select2 = require_select();
+    var select = require_select();
     var utils = require_utils8();
     function DocumentFragment(doc) {
       ContainerNode.call(this);
@@ -85238,7 +85238,7 @@ var require_DocumentFragment = __commonJS({
         context.isHTML = true;
         context.getElementsByTagName = Element.prototype.getElementsByTagName;
         context.nextElement = Object.getOwnPropertyDescriptor(Element.prototype, "firstElementChild").get;
-        var nodes = select2(selector, context);
+        var nodes = select(selector, context);
         return nodes.item ? nodes : new NodeList(nodes);
       } },
       // Utility methods
@@ -88353,7 +88353,7 @@ var require_Document = __commonJS({
     var NodeIterator = require_NodeIterator();
     var NodeFilter = require_NodeFilter();
     var URL2 = require_URL();
-    var select2 = require_select();
+    var select = require_select();
     var events = require_events3();
     var xml = require_xmlnames();
     var html = require_htmlelts();
@@ -88914,10 +88914,10 @@ var require_Document = __commonJS({
         return this._templateDocCache;
       } },
       querySelector: { value: function(selector) {
-        return select2(selector, this)[0];
+        return select(selector, this)[0];
       } },
       querySelectorAll: { value: function(selector) {
-        var nodes = select2(selector, this);
+        var nodes = select(selector, this);
         return nodes.item ? nodes : new NodeList(nodes);
       } }
     });
@@ -104596,8 +104596,8 @@ var providers = {
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
-        resolve: "vercel/anthropic/claude-sonnet-5",
-        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+        resolve: "vercel/anthropic/claude-sonnet-5.5",
+        effort: ["low", "medium", "high", "xhigh", "max"]
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
@@ -105723,7 +105723,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.85",
+  version: "0.1.86",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -107995,17 +107995,6 @@ function parseXaiAuthBody(raw2) {
 var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
 var XAI_AUTH_ENV = "GROK_AUTH_JSON";
 var installedSubscriptionPaths = /* @__PURE__ */ new Map();
-function clearInstalledSubscription(name) {
-  const path4 = installedSubscriptionPaths.get(name);
-  if (!path4 || !existsSync4(path4)) return;
-  const value2 = JSON.parse(readFileSync2(path4, "utf8"));
-  if (!value2 || typeof value2 !== "object") return;
-  if (name === "CODEX_AUTH_JSON" && "openai" in value2) delete value2.openai;
-  if (name === "GROK_AUTH_JSON" && "xai" in value2) delete value2.xai;
-  writeFileSync4(path4, `${JSON.stringify(value2)}
-`, { mode: 384 });
-  installedSubscriptionPaths.delete(name);
-}
 var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
 function isRejectedChain(body) {
   if (!body.refresh_rejected_at) return false;
@@ -194629,344 +194618,6 @@ async function checkConfiguredCredentials(params) {
   return replacement ? { kind: "fellBack", ...outcome, replacement } : { kind: "dead", ...outcome };
 }
 
-// utils/normalizeEnv.ts
-function hasControlCharacter(value2) {
-  return [...value2].some((ch) => {
-    const code = ch.charCodeAt(0);
-    return code < 32 || code === 127;
-  });
-}
-function sanitizeSecret(key, value2) {
-  const trimmed = value2.trim();
-  if (trimmed.length === 0) {
-    log.warning(
-      `\xBB ${key} is whitespace-only \u2014 leaving env var unchanged. check your secret value.`
-    );
-    return null;
-  }
-  if (key.endsWith("_API_KEY") && hasControlCharacter(trimmed)) {
-    log.warning(
-      `\xBB ${key} contains a line break or control character and cannot be sent as an HTTP header \u2014 leaving env var unchanged. re-save the secret as a single line.`
-    );
-    return null;
-  }
-  if (trimmed !== value2) {
-    log.warning(
-      `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
-    );
-  }
-  maskSecret(trimmed);
-  return trimmed;
-}
-function normalizeEnv() {
-  const upperKeys = /* @__PURE__ */ new Map();
-  for (const key of Object.keys(process.env)) {
-    const upper2 = key.toUpperCase();
-    const existing = upperKeys.get(upper2) || [];
-    existing.push(key);
-    upperKeys.set(upper2, existing);
-  }
-  for (const [upperKey, keys] of upperKeys) {
-    if (keys.length === 1) {
-      const key = keys[0];
-      if (key !== upperKey) {
-        process.env[upperKey] = process.env[key];
-        delete process.env[key];
-      }
-      continue;
-    }
-    const values = keys.map((k2) => process.env[k2]);
-    const uniqueValues = new Set(values);
-    if (uniqueValues.size > 1) {
-      log.warning(
-        `env var conflict: ${keys.join(", ")} have different values. using uppercase ${upperKey}.`
-      );
-    }
-    const preferredKey = keys.find((k2) => k2 === upperKey) || keys[0];
-    const preferredValue = process.env[preferredKey];
-    for (const key of keys) {
-      delete process.env[key];
-    }
-    process.env[upperKey] = preferredValue;
-  }
-  for (const key of Object.keys(process.env)) {
-    if (!isSensitiveEnvName(key)) continue;
-    const value2 = process.env[key];
-    if (typeof value2 !== "string" || value2.length === 0) continue;
-    const sanitized = sanitizeSecret(key, value2);
-    if (sanitized !== null) process.env[key] = sanitized;
-  }
-}
-
-// utils/subscriptionCredentials.ts
-var subscriptionNameSchema = external_exports.enum([
-  "CLAUDE_CODE_OAUTH_TOKEN",
-  "CODEX_AUTH_JSON",
-  "GROK_AUTH_JSON"
-]);
-var subscriptionSchema = external_exports.object({
-  id: external_exports.string(),
-  credentialId: external_exports.string(),
-  name: subscriptionNameSchema,
-  label: external_exports.string(),
-  owner: external_exports.string(),
-  inherited: external_exports.boolean(),
-  shared: external_exports.boolean(),
-  registeredAt: external_exports.string()
-});
-var subscriptionListSchema = external_exports.object({
-  subscriptions: external_exports.array(subscriptionSchema),
-  writable: external_exports.boolean()
-});
-var subscriptionInputSchema = external_exports.object({
-  name: subscriptionNameSchema,
-  value: external_exports.string().trim().min(1).refine((value2) => Buffer.byteLength(value2, "utf8") <= 49152),
-  replaceId: external_exports.string().optional()
-});
-var credentialCandidateSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  source: external_exports.enum(["repo", "account", "personal"])
-});
-var credentialAccessSchema = external_exports.object({
-  token: external_exports.string(),
-  candidates: external_exports.array(credentialCandidateSchema)
-});
-var selectedCredentialSchema = external_exports.object({
-  name: external_exports.string(),
-  value: external_exports.string(),
-  receipt: external_exports.string()
-});
-
-// utils/subscriptionProbe.ts
-var identitySchema = external_exports.object({
-  email: external_exports.string().email().optional(),
-  sub: external_exports.string().optional(),
-  user_id: external_exports.string().optional(),
-  account_id: external_exports.string().optional(),
-  email_verified: external_exports.boolean().optional()
-});
-var codexUsageSchema = external_exports.object({
-  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
-});
-async function readSubscriptionEndpoint(input) {
-  const headers = new Headers({ authorization: `Bearer ${input.token}` });
-  if (input.accountId) headers.set("ChatGPT-Account-Id", input.accountId);
-  if (input.grokBilling) headers.set("x-xai-token-auth", "xai-grok-cli");
-  return fetch(input.url, {
-    headers,
-    redirect: "error",
-    signal: AbortSignal.timeout(1e4)
-  }).catch(() => null);
-}
-async function probeSubscription(input) {
-  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
-    const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
-    return result.usable ? "usable" : "rejected";
-  }
-  const codex2 = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
-  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
-  const auth2 = codex2 ?? grok;
-  if (!auth2 || auth2.refresh_rejected_at) return "rejected";
-  if (grok && input.model)
-    return probeInference({
-      name: "XAI_API_KEY",
-      value: grok.tokens.access_token,
-      model: input.model
-    });
-  const response = await readSubscriptionEndpoint({
-    url: codex2 ? "https://chatgpt.com/backend-api/wham/usage" : "https://cli-chat-proxy.grok.com/v1/billing?format=credits",
-    token: auth2.tokens.access_token,
-    accountId: codex2?.tokens.account_id,
-    grokBilling: !!grok
-  });
-  if (response?.status === 401) return "rejected";
-  if (!response?.ok) return "unknown";
-  const body = await response.json().catch(() => null);
-  if (codex2) {
-    const parsed2 = codexUsageSchema.safeParse(body);
-    const limit = parsed2.success ? parsed2.data.rate_limit : void 0;
-    if (!limit) return "unknown";
-    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
-  }
-  return "unknown";
-}
-async function probeInference(input) {
-  const anthropic = input.name === "ANTHROPIC_API_KEY";
-  const openai = input.name === "OPENAI_API_KEY";
-  if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
-    const result = await verifyCredential({ envVar: input.name, value: input.value });
-    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
-  }
-  const headers = new Headers({ "content-type": "application/json" });
-  if (anthropic) {
-    headers.set("x-api-key", input.value);
-    headers.set("anthropic-version", "2023-06-01");
-  } else headers.set("authorization", `Bearer ${input.value}`);
-  const response = await fetch(
-    anthropic ? "https://api.anthropic.com/v1/messages" : openai ? "https://api.openai.com/v1/responses" : "https://api.x.ai/v1/chat/completions",
-    {
-      method: "POST",
-      headers,
-      body: JSON.stringify(
-        openai ? { model: input.model, input: "Reply OK.", max_output_tokens: 16, store: false } : {
-          model: input.model,
-          messages: [{ role: "user", content: "Reply OK." }],
-          max_tokens: 1
-        }
-      ),
-      redirect: "error",
-      signal: AbortSignal.timeout(1e4)
-    }
-  ).catch(() => null);
-  if (response?.status === 400 && input.name === "XAI_API_KEY") {
-    const error49 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
-    return error49.success && error49.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
-  }
-  await response?.body?.cancel();
-  if (!response) return "unknown";
-  if (response.ok) return "usable";
-  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
-}
-
-// utils/credentialPool.ts
-var receipts = {};
-var workflowCredentials = {};
-function saveReceipts() {
-  for (const receipt of Object.values(receipts)) maskSecret(receipt);
-  saveSecretState("credential_receipts", JSON.stringify(receipts));
-}
-var select = op(
-  async (input) => {
-    const response = await apiFetch({
-      path: "/api/runtime/credentials",
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${input.access.token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ id: input.candidate.id }),
-      signal: AbortSignal.timeout(35e3)
-    });
-    if (response.status === 404) return null;
-    if (!response.ok)
-      throw new Error("could not load a configured credential; no fallback was charged", {
-        cause: response.status
-      });
-    return selectedCredentialSchema.parse(await response.json());
-  },
-  {
-    retries: [250, 1e3],
-    bail: (error49) => error49 instanceof Error && typeof error49.cause === "number" && error49.cause >= 400 && error49.cause < 500
-  }
-);
-function subscriptionForModel(model) {
-  if (!model.includes("/")) return null;
-  const provider2 = getModelProvider(model);
-  return provider2 === "anthropic" ? "CLAUDE_CODE_OAUTH_TOKEN" : provider2 === "openai" ? "CODEX_AUTH_JSON" : provider2 === "xai" ? "GROK_AUTH_JSON" : null;
-}
-async function initializeCredentialPool(ctx, model) {
-  const access = ctx.credentialAccess;
-  if (!access) return;
-  maskSecret(access.token);
-  const names = /* @__PURE__ */ new Set([
-    ...access.candidates.map((candidate) => candidate.name),
-    ...subscriptionNameSchema.options,
-    "ANTHROPIC_API_KEY",
-    "OPENAI_API_KEY",
-    "XAI_API_KEY"
-  ]);
-  for (const name of names) {
-    const value2 = process.env[name];
-    if (value2) workflowCredentials[name] = value2;
-  }
-  for (const name of subscriptionNameSchema.options) {
-    if (model && subscriptionForModel(model) !== name) continue;
-    if (workflowCredentials[name]) continue;
-    const candidate = access.candidates.find((item) => item.name === name);
-    if (!candidate) continue;
-    const selected = await select({ access, candidate }).catch(() => {
-      log.warning(`\xBB could not load ${name} for model discovery; selection will retry if needed`);
-      return null;
-    });
-    if (!selected) continue;
-    const value2 = sanitizeSecret(name, selected.value);
-    if (!value2) continue;
-    process.env[name] = value2;
-    receipts[name] = selected.receipt;
-  }
-  saveReceipts();
-}
-function resolvePoolModel(input) {
-  const agent2 = resolveAgent({
-    model: void 0,
-    proxyModel: void 0,
-    codexAgent: input.codexAgent
-  });
-  if (agent2.name === "opencode") return autoSelectModel();
-  const provider2 = agent2.name === "claude" ? "anthropic" : "openai";
-  return modelAliases.find(
-    (alias) => alias.provider === provider2 && alias.preferred && !alias.hidden && !alias.fallback && !alias.routing
-  )?.resolve;
-}
-async function selectConfiguredCredential(input) {
-  const access = input.ctx.credentialAccess;
-  const model = input.model;
-  if (!access || !model?.includes("/") || getProviderGatewayUrl(model)) return false;
-  const subscription = subscriptionForModel(model);
-  const names = getModelEnvVars(model).filter((name) => name !== subscription);
-  if (subscription) names.unshift(subscription);
-  const candidates = access.candidates.filter((candidate) => names.includes(candidate.name));
-  const workflow = names.filter((name) => workflowCredentials[name]);
-  if (!candidates.length && !workflow.length) return false;
-  for (const name of workflow) {
-    const value2 = workflowCredentials[name];
-    if (await usable({ name, value: value2, model })) {
-      activate({ names, name, value: value2, receipt: void 0 });
-      return true;
-    }
-  }
-  for (const candidate of candidates) {
-    const selected = await select({ access, candidate });
-    if (!selected) continue;
-    if (await usable({ ...selected, model })) {
-      activate({ names, ...selected });
-      log.info(`\xBB selected ${candidate.name} from ${candidate.source} scope`);
-      return true;
-    }
-    log.info(
-      `\xBB ${candidate.name} from ${candidate.source} scope unavailable; trying the next credential`
-    );
-  }
-  throw new Error(
-    `all configured credentials for ${model} were rejected or exhausted; no other model or provider was selected`
-  );
-}
-async function usable(input) {
-  const subscription = subscriptionNameSchema.safeParse(input.name);
-  if (subscription.success)
-    return await probeSubscription({
-      name: subscription.data,
-      value: input.value,
-      model: stripProviderPrefix(input.model)
-    }) !== "rejected";
-  return await probeInference({ ...input, model: stripProviderPrefix(input.model) }) !== "rejected";
-}
-function activate(input) {
-  for (const name of input.names) {
-    delete process.env[name];
-    delete receipts[name];
-    if (name === "CODEX_AUTH_JSON" || name === "GROK_AUTH_JSON") clearInstalledSubscription(name);
-  }
-  const value2 = sanitizeSecret(input.name, input.value);
-  if (!value2) throw new Error("configured credential was empty");
-  process.env[input.name] = value2;
-  if (input.receipt) receipts[input.name] = input.receipt;
-  installCodexAuth();
-  installXaiAuth();
-  saveReceipts();
-}
-
 // utils/gitAuthServer.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync14 } from "node:fs";
@@ -195670,6 +195321,75 @@ function buildModelAccessError(input) {
   return [headline, "", why, "", cta].join("\n");
 }
 
+// utils/normalizeEnv.ts
+function hasControlCharacter(value2) {
+  return [...value2].some((ch) => {
+    const code = ch.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+}
+function sanitizeSecret(key, value2) {
+  const trimmed = value2.trim();
+  if (trimmed.length === 0) {
+    log.warning(
+      `\xBB ${key} is whitespace-only \u2014 leaving env var unchanged. check your secret value.`
+    );
+    return null;
+  }
+  if (key.endsWith("_API_KEY") && hasControlCharacter(trimmed)) {
+    log.warning(
+      `\xBB ${key} contains a line break or control character and cannot be sent as an HTTP header \u2014 leaving env var unchanged. re-save the secret as a single line.`
+    );
+    return null;
+  }
+  if (trimmed !== value2) {
+    log.warning(
+      `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
+    );
+  }
+  maskSecret(trimmed);
+  return trimmed;
+}
+function normalizeEnv() {
+  const upperKeys = /* @__PURE__ */ new Map();
+  for (const key of Object.keys(process.env)) {
+    const upper2 = key.toUpperCase();
+    const existing = upperKeys.get(upper2) || [];
+    existing.push(key);
+    upperKeys.set(upper2, existing);
+  }
+  for (const [upperKey, keys] of upperKeys) {
+    if (keys.length === 1) {
+      const key = keys[0];
+      if (key !== upperKey) {
+        process.env[upperKey] = process.env[key];
+        delete process.env[key];
+      }
+      continue;
+    }
+    const values = keys.map((k2) => process.env[k2]);
+    const uniqueValues = new Set(values);
+    if (uniqueValues.size > 1) {
+      log.warning(
+        `env var conflict: ${keys.join(", ")} have different values. using uppercase ${upperKey}.`
+      );
+    }
+    const preferredKey = keys.find((k2) => k2 === upperKey) || keys[0];
+    const preferredValue = process.env[preferredKey];
+    for (const key of keys) {
+      delete process.env[key];
+    }
+    process.env[upperKey] = preferredValue;
+  }
+  for (const key of Object.keys(process.env)) {
+    if (!isSensitiveEnvName(key)) continue;
+    const value2 = process.env[key];
+    if (typeof value2 !== "string" || value2.length === 0) continue;
+    const sanitized = sanitizeSecret(key, value2);
+    if (sanitized !== null) process.env[key] = sanitized;
+  }
+}
+
 // utils/overrides.ts
 var DENIED_OVERRIDE_NAMES = /* @__PURE__ */ new Set([
   "GITHUB_TOKEN",
@@ -196624,8 +196344,7 @@ async function fetchRunContext(params) {
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const headers = {
-      Authorization: `Bearer ${params.token}`,
-      "X-Pullfrog-Credential-Pools": "1"
+      Authorization: `Bearer ${params.token}`
     };
     if (params.oidcToken) {
       headers["X-GitHub-OIDC-Token"] = params.oidcToken;
@@ -197895,7 +197614,6 @@ async function main() {
     const preIntrospectionDirty = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
     const opencodeCliPath = await agents.opencode.install();
     captureBaselineModels(opencodeCliPath);
-    await initializeCredentialPool(runContext, resolveModel({ slug: payload.model }));
     if (runContext.dbSecrets) {
       for (const [key, value2] of Object.entries(runContext.dbSecrets)) {
         if (!process.env[key]) {
@@ -197979,27 +197697,14 @@ async function main() {
         }
         const gitAuthServer = __using(_stack2, await startGitAuthServer(tmpdir3), true);
         setGitAuthServer(gitAuthServer);
-        let configuredModel = resolveModel({ slug: payload.model });
-        if (!configuredModel && !payload.proxyModel && runContext.credentialAccess?.candidates.length) {
-          configuredModel = resolvePoolModel({
-            codexAgent: runContext.repoSettings.codexAgent || payload.codexArm === true
-          });
-        }
-        let poolSelected = !payload.proxyModel && await selectConfiguredCredential({
-          ctx: runContext,
-          model: configuredModel
-        });
         const access = decideModelAccess({
           modelExplicit: payload.modelExplicit ?? false,
           model: payload.model,
           oss: runContext.oss,
           proxyActive: !!payload.proxyModel,
           subsidyTarget: runContext.proxyModel,
-          resolvedModel: configuredModel,
-          authorized: /* @__PURE__ */ new Set([
-            ...getAuthorizedModels(),
-            ...poolSelected && configuredModel ? [configuredModel] : []
-          ])
+          resolvedModel: resolveModel({ slug: payload.model }),
+          authorized: getAuthorizedModels()
         });
         if (access.kind === "error") {
           throw new Error(
@@ -198012,25 +197717,12 @@ async function main() {
           );
         }
         if (access.kind === "proxy") payload.proxyModel = access.target;
-        if (access.kind === "byok") {
-          payload.proxyModel = void 0;
-          if (!poolSelected)
-            poolSelected = await selectConfiguredCredential({
-              ctx: runContext,
-              model: configuredModel
-            });
-        }
-        if (poolSelected) {
-          const before = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
-          captureAuthorizedModels(opencodeCliPath);
-          if (before && repoDir)
-            await restoreDirtiedSince({ before, actor: "model introspection", cwd: repoDir });
-        }
+        if (access.kind === "byok") payload.proxyModel = void 0;
         if (runContext.oss && payload.proxyModel) {
           payload.effort = ossEffortFloor({ payload });
         }
-        if (payload.proxyModel) configuredModel = void 0;
-        const credentials = payload.proxyModel || poolSelected ? { kind: "ok" } : await checkConfiguredCredentials({
+        const configuredModel = payload.proxyModel ? void 0 : resolveModel({ slug: payload.model });
+        const credentials = payload.proxyModel ? { kind: "ok" } : await checkConfiguredCredentials({
           model: configuredModel,
           authorized: getAuthorizedModels()
         });
@@ -198361,12 +198053,12 @@ ${instructions.user}` : null,
         if (payload.timeout === TIMEOUT_DISABLED) {
           result = await Promise.race([agentPromise, activityTimeout.promise]);
         } else {
-          const usable2 = resolveTimeoutMs(payload.timeout);
-          if (payload.timeout && usable2 === null) {
+          const usable = resolveTimeoutMs(payload.timeout);
+          if (payload.timeout && usable === null) {
             log.warning(`invalid timeout "${payload.timeout}" (use --notimeout to disable), using 1h`);
           }
-          const timeoutMs = usable2 ?? 36e5;
-          const actualTimeout = usable2 !== null ? payload.timeout : "1h";
+          const timeoutMs = usable ?? 36e5;
+          const actualTimeout = usable !== null ? payload.timeout : "1h";
           let timeoutId;
           const timeoutPromise = new Promise((_4, reject) => {
             timeoutId = setTimeout(() => {

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.85",
+  version: "0.1.86",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -15487,8 +15487,8 @@ var providers = {
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
-        resolve: "vercel/anthropic/claude-sonnet-5",
-        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+        resolve: "vercel/anthropic/claude-sonnet-5.5",
+        effort: ["low", "medium", "high", "xhigh", "max"]
       },
       "claude-haiku": {
         displayName: "Claude Haiku",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {

package/dist/utils/credentialPool.d.ts

@@ -1,10 +0,0 @@
-import type { RunContextData } from "./runContextData.ts";
-/** load one subscription per provider for model discovery; keep the pool unflattened. */
-export declare function initializeCredentialPool(ctx: RunContextData, model?: string): Promise<void>;
-export declare function resolvePoolModel(input: {
-    codexAgent: boolean;
-}): string | undefined;
-export declare function selectConfiguredCredential(input: {
-    ctx: RunContextData;
-    model: string | undefined;
-}): Promise<boolean>;