pullfrog 0.1.91 → 0.1.92

package/dist/cli.mjs

@@ -107103,7 +107103,7 @@ var import_picocolors = __toESM(require_picocolors(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.91",
+  version: "0.1.92",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -110397,6 +110397,9 @@ function stripProviderPrefix(specifier) {
   const slashIndex = specifier.indexOf("/");
   return slashIndex > 0 ? specifier.slice(slashIndex + 1) : specifier;
 }
+function modelIdLabel(specifier) {
+  return specifier.slice(specifier.lastIndexOf("/") + 1).replace(/^~/, "");
+}
 function getModelEnvVars(slug2) {
   const parsed2 = parseModel(slug2);
   const providerConfig = providers[parsed2.provider];
@@ -113559,6 +113562,7 @@ function installCodexAuth() {
   if (isRejectedChain(body)) return null;
   const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
   const opencodeDir = join6(xdgDataHome, "opencode");
   const authPath = join6(opencodeDir, "auth.json");
   writeOpenCodeAuthEntry({
@@ -113608,6 +113612,7 @@ function installXaiAuth() {
   }
   if (isXaiRejectedChain(body)) return null;
   const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
   const opencodeDir = join6(xdgDataHome, "opencode");
   const authPath = join6(opencodeDir, "auth.json");
   writeOpenCodeAuthEntry({
@@ -113652,17 +113657,23 @@ function installCodexHome() {
     );
     return null;
   }
-  const codexHome = join6(resolveDataHome(), "codex");
+  const root = resolveDataHome();
+  if (!root) return null;
+  const codexHome = join6(root, "codex");
   const authPath = join6(codexHome, "auth.json");
   mkdirSync5(codexHome, { recursive: true });
   writeFileSync5(authPath, stringifyCodexAuthBody(body), { mode: 384 });
   log2.info(`\xBB installed Codex auth at ${authPath}`);
   return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
 }
+var dataHome;
+function canInstallSubscription(name) {
+  return name !== CODEX_AUTH_ENV && name !== XAI_AUTH_ENV || resolveDataHome() !== null;
+}
 function resolveDataHome() {
   if (process.env.CI !== "true") return join6(homedir2(), ".local", "share");
-  bootstrapPullfrogDataDir();
-  return PULLFROG_DATA_DIR;
+  if (dataHome === void 0) dataHome = bootstrapPullfrogDataDir();
+  return dataHome;
 }
 function bootstrapPullfrogDataDir() {
   const user = userInfo().username;
@@ -113679,10 +113690,14 @@ function bootstrapPullfrogDataDir() {
     });
     execFileSync4("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
   } catch (err) {
-    throw new Error(
-      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
+    log2.warning(
+      `\xBB subscription auth skipped: could not create ${PULLFROG_DATA_DIR} (${err instanceof Error ? err.message : String(err)}). it must live outside the agent sandbox's reach, which needs passwordless sudo on this runner; runs on a model that needs the subscription will report no key.`
     );
+    delete process.env[CODEX_AUTH_ENV];
+    delete process.env[XAI_AUTH_ENV];
+    return null;
   }
+  return PULLFROG_DATA_DIR;
 }
 
 // utils/oauthWriteback.ts
@@ -192292,19 +192307,19 @@ function PushTagsTool(ctx) {
 var PULLFROG_DIVIDER = "<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->";
 var FROG_LOGO = `<a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>`;
 function formatModelLabel(params) {
-  const alias = resolveDisplayAlias(params.model) ?? // reverse-lookup: when the caller passes an effective model (proxy or
+  const slugAlias = resolveDisplayAlias(params.model);
+  const alias = slugAlias ?? // reverse-lookup: when the caller passes an effective model (proxy or
   // resolved target like "openrouter/anthropic/claude-opus-4.7") instead of
-  // a stored alias slug, find the alias whose resolve target matches so we
-  // still render a friendly display name.
+  // a stored alias slug, find the alias whose resolve target matches.
   modelAliases.find((a2) => a2.resolve === params.model || a2.openRouterResolve === params.model);
-  const displayName = alias?.displayName ?? params.model;
+  const modelName = slugAlias?.routing ? slugAlias.displayName : modelIdLabel(slugAlias?.resolve ?? params.model);
   if (params.oss) {
-    const ossBase = `\`${displayName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
+    const ossBase = `\`${modelName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
     if (params.clamped?.reason !== "oss") return ossBase;
     const configured = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
     return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
-  const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
+  const base = alias?.isFree ? `\`${modelName}\` (free)` : `\`${modelName}\``;
   if (params.clamped?.reason === "trial") {
     return `${base} (model usage covered by Pullfrog)`;
   }
@@ -198405,10 +198420,14 @@ async function selectConfiguredCredential(input) {
   const subscription = subscriptionForModel(model);
   const names = getModelEnvVars(model).filter((name) => name !== subscription);
   if (subscription) names.unshift(subscription);
-  const candidates = access.candidates.filter((candidate) => names.includes(candidate.name));
+  const candidates = access.candidates.filter(
+    (candidate) => names.includes(candidate.name) && canInstallSubscription(candidate.name)
+  );
   if (!candidates.length) return false;
   const refused = [];
-  for (const name of names.filter((item) => workflowCredentials[item])) {
+  for (const name of names.filter(
+    (item) => workflowCredentials[item] && canInstallSubscription(item)
+  )) {
     const value2 = workflowCredentials[name];
     const verdict = await probe({ name, value: value2, model });
     if (usable(verdict)) {
@@ -202508,7 +202527,7 @@ function resolveTarget2(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.91");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.92");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -202675,7 +202694,7 @@ async function runCli8(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.91";
+var VERSION10 = "0.1.92";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/external.d.ts

@@ -53,7 +53,7 @@ export declare function findDanglingPromptToolRefs(params: {
 export type { EffortPosition } from "./effort.ts";
 export { DEFAULT_EFFORT_POSITION, EFFORT_ALIASES, isEffortPosition, offeredRungs, parseEffortPosition, resolveRung, rungLabel, rungPosition, SUBSIDY_RUNG, } from "./effort.ts";
 export type { AutoTier, ModelAlias, ModelProvider, ProviderConfig, RouterTier, } from "./models.ts";
-export { AUTO_EFFICIENT, AUTO_INTELLIGENT, AUTO_ROUTER, autoLadder, autoRoutedSlug, DEFAULT_PROXY_MODEL, defaultAutoTier, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoRouted, isAutoSlug, isAutoTier, isCardGatedModel, isOssAllowedModel, isRouterTier, ladderRungs, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, ossFundedModelNames, PROVIDER_GATEWAY_URL_ENV, parseModel, providers, ROUTED_PROVIDERS, ROUTER_LADDER, ROUTER_TIERS, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRoutedModel, } from "./models.ts";
+export { AUTO_EFFICIENT, AUTO_INTELLIGENT, AUTO_ROUTER, autoLadder, autoRoutedSlug, DEFAULT_PROXY_MODEL, defaultAutoTier, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoRouted, isAutoSlug, isAutoTier, isCardGatedModel, isOssAllowedModel, isRouterTier, ladderRungs, modelAliases, modelHasStoredAuth, modelIdLabel, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, ossFundedModelNames, PROVIDER_GATEWAY_URL_ENV, parseModel, pickUsesOpenRouter, providers, ROUTED_PROVIDERS, ROUTER_LADDER, ROUTER_TIERS, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRoutedModel, routerProxyOptOut, } from "./models.ts";
 export type ToolPermission = "disabled" | "enabled";
 export type ShellPermission = "disabled" | "restricted" | "enabled";
 export type PushPermission = "disabled" | "restricted" | "enabled";

package/dist/index.js

@@ -104680,6 +104680,9 @@ function stripProviderPrefix(specifier) {
   const slashIndex = specifier.indexOf("/");
   return slashIndex > 0 ? specifier.slice(slashIndex + 1) : specifier;
 }
+function modelIdLabel(specifier) {
+  return specifier.slice(specifier.lastIndexOf("/") + 1).replace(/^~/, "");
+}
 function getModelEnvVars(slug2) {
   const parsed2 = parseModel(slug2);
   const providerConfig = providers[parsed2.provider];
@@ -105731,7 +105734,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.91",
+  version: "0.1.92",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -108033,6 +108036,7 @@ function installCodexAuth() {
   if (isRejectedChain(body)) return null;
   const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
   const opencodeDir = join5(xdgDataHome, "opencode");
   const authPath = join5(opencodeDir, "auth.json");
   writeOpenCodeAuthEntry({
@@ -108082,6 +108086,7 @@ function installXaiAuth() {
   }
   if (isXaiRejectedChain(body)) return null;
   const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
   const opencodeDir = join5(xdgDataHome, "opencode");
   const authPath = join5(opencodeDir, "auth.json");
   writeOpenCodeAuthEntry({
@@ -108126,17 +108131,23 @@ function installCodexHome() {
     );
     return null;
   }
-  const codexHome = join5(resolveDataHome(), "codex");
+  const root = resolveDataHome();
+  if (!root) return null;
+  const codexHome = join5(root, "codex");
   const authPath = join5(codexHome, "auth.json");
   mkdirSync5(codexHome, { recursive: true });
   writeFileSync4(authPath, stringifyCodexAuthBody(body), { mode: 384 });
   log.info(`\xBB installed Codex auth at ${authPath}`);
   return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
 }
+var dataHome;
+function canInstallSubscription(name) {
+  return name !== CODEX_AUTH_ENV && name !== XAI_AUTH_ENV || resolveDataHome() !== null;
+}
 function resolveDataHome() {
   if (process.env.CI !== "true") return join5(homedir2(), ".local", "share");
-  bootstrapPullfrogDataDir();
-  return PULLFROG_DATA_DIR;
+  if (dataHome === void 0) dataHome = bootstrapPullfrogDataDir();
+  return dataHome;
 }
 function bootstrapPullfrogDataDir() {
   const user = userInfo().username;
@@ -108153,10 +108164,14 @@ function bootstrapPullfrogDataDir() {
     });
     execFileSync3("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
   } catch (err) {
-    throw new Error(
-      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
+    log.warning(
+      `\xBB subscription auth skipped: could not create ${PULLFROG_DATA_DIR} (${err instanceof Error ? err.message : String(err)}). it must live outside the agent sandbox's reach, which needs passwordless sudo on this runner; runs on a model that needs the subscription will report no key.`
     );
+    delete process.env[CODEX_AUTH_ENV];
+    delete process.env[XAI_AUTH_ENV];
+    return null;
   }
+  return PULLFROG_DATA_DIR;
 }
 
 // utils/oauthWriteback.ts
@@ -188782,19 +188797,19 @@ function PushTagsTool(ctx) {
 var PULLFROG_DIVIDER = "<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->";
 var FROG_LOGO = `<a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>`;
 function formatModelLabel(params) {
-  const alias = resolveDisplayAlias(params.model) ?? // reverse-lookup: when the caller passes an effective model (proxy or
+  const slugAlias = resolveDisplayAlias(params.model);
+  const alias = slugAlias ?? // reverse-lookup: when the caller passes an effective model (proxy or
   // resolved target like "openrouter/anthropic/claude-opus-4.7") instead of
-  // a stored alias slug, find the alias whose resolve target matches so we
-  // still render a friendly display name.
+  // a stored alias slug, find the alias whose resolve target matches.
   modelAliases.find((a) => a.resolve === params.model || a.openRouterResolve === params.model);
-  const displayName = alias?.displayName ?? params.model;
+  const modelName = slugAlias?.routing ? slugAlias.displayName : modelIdLabel(slugAlias?.resolve ?? params.model);
   if (params.oss) {
-    const ossBase = `\`${displayName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
+    const ossBase = `\`${modelName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
     if (params.clamped?.reason !== "oss") return ossBase;
     const configured = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
     return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
-  const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
+  const base = alias?.isFree ? `\`${modelName}\` (free)` : `\`${modelName}\``;
   if (params.clamped?.reason === "trial") {
     return `${base} (model usage covered by Pullfrog)`;
   }
@@ -194938,10 +194953,14 @@ async function selectConfiguredCredential(input) {
   const subscription = subscriptionForModel(model);
   const names = getModelEnvVars(model).filter((name) => name !== subscription);
   if (subscription) names.unshift(subscription);
-  const candidates = access.candidates.filter((candidate) => names.includes(candidate.name));
+  const candidates = access.candidates.filter(
+    (candidate) => names.includes(candidate.name) && canInstallSubscription(candidate.name)
+  );
   if (!candidates.length) return false;
   const refused = [];
-  for (const name of names.filter((item) => workflowCredentials[item])) {
+  for (const name of names.filter(
+    (item) => workflowCredentials[item] && canInstallSubscription(item)
+  )) {
     const value2 = workflowCredentials[name];
     const verdict = await probe({ name, value: value2, model });
     if (usable(verdict)) {

package/dist/internal/index.d.ts

@@ -6,7 +6,7 @@ export { CLI_CONTRACT_HEADER, CLI_CONTRACT_VERSION, CLI_UPGRADE_MESSAGE } from "
 export type { ConfigField, ConfigScope, ConfigValue } from "../configuration.ts";
 export { configEntrySchema, configFields, configResponseSchema, configValueSchema, } from "../configuration.ts";
 export type { AuthorPermission, AutoTier, EffortPosition, ModelAlias, ModelProvider, Payload, PayloadEvent, PayloadRouting, ProviderConfig, PushPermission, RouterSource, RouterTier, ShellPermission, ToolPermission, WriteablePayload, XrepoConfig, } from "../external.ts";
-export { AUTO_EFFICIENT, AUTO_INTELLIGENT, AUTO_ROUTER, autoLadder, autoRoutedSlug, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoRouted, isAutoSlug, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, isRouterTier, ladderRungs, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, ossFundedModelNames, PROVIDER_GATEWAY_URL_ENV, parseEffortPosition, parseModel, providers, pullfrogMcpName, ROUTED_PROVIDERS, ROUTER_LADDER, ROUTER_TIERS, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRoutedModel, resolveRung, rungLabel, rungPosition, SUBSIDY_RUNG, } from "../external.ts";
+export { AUTO_EFFICIENT, AUTO_INTELLIGENT, AUTO_ROUTER, autoLadder, autoRoutedSlug, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoRouted, isAutoSlug, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, isRouterTier, ladderRungs, modelAliases, modelHasStoredAuth, modelIdLabel, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, ossFundedModelNames, PROVIDER_GATEWAY_URL_ENV, parseEffortPosition, parseModel, pickUsesOpenRouter, providers, pullfrogMcpName, ROUTED_PROVIDERS, ROUTER_LADDER, ROUTER_TIERS, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRoutedModel, resolveRung, routerProxyOptOut, rungLabel, rungPosition, SUBSIDY_RUNG, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export { type CommercialRefusal, commercialPaywallBody } from "../utils/billingErrors.ts";

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.91",
+  version: "0.1.92",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -15571,6 +15571,9 @@ function getProviderDisplayName(slug) {
   const parsed = parseModel(slug);
   return providers[parsed.provider]?.displayName;
 }
+function modelIdLabel(specifier) {
+  return specifier.slice(specifier.lastIndexOf("/") + 1).replace(/^~/, "");
+}
 function getModelEnvVars(slug) {
   const parsed = parseModel(slug);
   const providerConfig = providers[parsed.provider];
@@ -15601,6 +15604,13 @@ function modelHasStoredAuth(params) {
   ];
   return authVars.some((v) => params.secretNames.includes(v));
 }
+function routerProxyOptOut(ctx) {
+  if (ctx.slug === null) return false;
+  return resolveDisplayAlias(ctx.slug)?.isFree === true || modelHasStoredAuth({ model: ctx.slug, secretNames: ctx.secretNames });
+}
+function pickUsesOpenRouter(params) {
+  return params.proxied && !routerProxyOptOut(params);
+}
 var modelAliases = Object.entries(providers).flatMap(
   ([providerKey, config2]) => Object.entries(config2.models).map(([modelId, def]) => ({
     slug: `${providerKey}/${modelId}`,
@@ -16247,19 +16257,19 @@ function commercialPaywallBody(params) {
 var PULLFROG_DIVIDER = "<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->";
 var FROG_LOGO = `<a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>`;
 function formatModelLabel(params) {
-  const alias = resolveDisplayAlias(params.model) ?? // reverse-lookup: when the caller passes an effective model (proxy or
+  const slugAlias = resolveDisplayAlias(params.model);
+  const alias = slugAlias ?? // reverse-lookup: when the caller passes an effective model (proxy or
   // resolved target like "openrouter/anthropic/claude-opus-4.7") instead of
-  // a stored alias slug, find the alias whose resolve target matches so we
-  // still render a friendly display name.
+  // a stored alias slug, find the alias whose resolve target matches.
   modelAliases.find((a) => a.resolve === params.model || a.openRouterResolve === params.model);
-  const displayName = alias?.displayName ?? params.model;
+  const modelName = slugAlias?.routing ? slugAlias.displayName : modelIdLabel(slugAlias?.resolve ?? params.model);
   if (params.oss) {
-    const ossBase = `\`${displayName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
+    const ossBase = `\`${modelName}\` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss))`;
     if (params.clamped?.reason !== "oss") return ossBase;
     const configured = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
     return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
-  const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
+  const base = alias?.isFree ? `\`${modelName}\` (free)` : `\`${modelName}\``;
   if (params.clamped?.reason === "trial") {
     return `${base} (model usage covered by Pullfrog)`;
   }
@@ -17396,6 +17406,7 @@ export {
   ladderRungs,
   modelAliases,
   modelHasStoredAuth,
+  modelIdLabel,
   modes,
   offeredRungs,
   ossFundedModelNames,
@@ -17404,6 +17415,7 @@ export {
   parseModel,
   parseTimeString,
   parseXaiAuthBody,
+  pickUsesOpenRouter,
   probeSubscription,
   providers,
   pullfrogMcpName,
@@ -17417,6 +17429,7 @@ export {
   resolveOpenRouterModel,
   resolveRoutedModel,
   resolveRung,
+  routerProxyOptOut,
   runStatusCheckNeedsFinalizing,
   rungLabel,
   rungPosition,

package/dist/models.d.ts

@@ -140,6 +140,9 @@ export declare function getModelProvider(slug: string): string;
 export declare function getProviderDisplayName(slug: string): string | undefined;
 /** provider-prefixed specifier → bare model id (`anthropic/claude-opus-5` → `claude-opus-5`). */
 export declare function stripProviderPrefix(specifier: string): string;
+/** specifier → the model's own id, for display: `openrouter/~anthropic/claude-opus-latest` →
+ * `claude-opus-latest`. names what an alias points at today, which its name does not. */
+export declare function modelIdLabel(specifier: string): string;
 export declare function getModelEnvVars(slug: string): string[];
 /** managed credentials are authored only via `pullfrog auth <provider>` — they
  * count as "configured" for hasAnyKey-style UI checks but are never offered as
@@ -180,6 +183,28 @@ export declare function modelHasStoredAuth(params: {
     model: string;
     secretNames: string[];
 }): boolean;
+/**
+ * `proxyOptOut`, spelled the way run-context spells it: a Router run skips the
+ * mint when the pick is FREE or a Pullfrog-stored key covers it, and then runs
+ * as-configured rather than clamping to the auto tier.
+ *
+ * one predicate for every reader — the console picker's `customLocked`, the
+ * effort ladder's `resolveRunning` and `pickUsesOpenRouter`. they held two
+ * copies and the free half was missing from both, which put the whole `opencode/*` free tier (`opencode/big-pickle`
+ * is `preferred`, so the most-picked model there is) behind "add a payment
+ * method to run it" on a card-less Router repo, against a server that ran it.
+ */
+export declare function routerProxyOptOut(ctx: {
+    slug: string | null;
+    secretNames: string[];
+}): boolean;
+/** whether a pick runs as its OpenRouter target: a proxied account (Router, the OSS subsidy)
+ * mints for every pick `routerProxyOptOut` does not exempt. */
+export declare function pickUsesOpenRouter(params: {
+    slug: string;
+    proxied: boolean;
+    secretNames: string[];
+}): boolean;
 export declare const modelAliases: ModelAlias[];
 /**
  * `repo.model` sentinels for the two managed auto tiers. stored verbatim in

package/dist/utils/buildPullfrogFooter.d.ts

@@ -15,14 +15,14 @@ export interface BuildPullfrogFooterParams {
     workflowRunUrl?: string | undefined;
     /** arbitrary custom parts (e.g., action links) */
     customParts?: string[] | undefined;
-    /** model slug from payload (e.g., "anthropic/claude-opus"). shown in footer as "Using `Model Name`" */
+    /** model slug from payload (e.g., "anthropic/claude-opus"). shown in footer as the model it runs: "Using `claude-opus-5-5`" */
     model?: string | undefined;
     /**
      * When a Router account had a model (or the intelligent tier) selected that
      * the server clamped to the efficient default — custom picks are card-gated
      * wholesale. `from` is the configured slug (e.g. "anthropic/claude-opus");
      * `reason` names the binding constraint — "card" (no card on file) renders
-     * `Using <Kimi K2> (<Claude Opus> needs a card on file)`, "noRouterPath"
+     * `Using <kimi-k2> (<Claude Opus> needs a card on file)`, "noRouterPath"
      * (no openRouterResolve yet and no stored provider key) renders a
      * provider-key nudge — so the downgrade is visible rather than silently
      * presenting Kimi as the pick.

package/dist/utils/codexHome.d.ts

@@ -26,7 +26,8 @@ export interface InstalledCodexAuth {
     originalIdToken: string | undefined;
 }
 /** materialize CODEX_AUTH_JSON from env into a disk path OpenCode reads from.
- * returns null when the env var is absent, malformed, or wrong auth mode —
+ * returns null when the env var is absent, malformed, or wrong auth mode, or
+ * when this runner cannot host it (`resolveDataHome`) —
  * caller treats null as "no codex auth, fall through to API key flow".
  *
  * The env value is server-side guaranteed fresh by `maybeRotateCodexSecret`
@@ -52,7 +53,8 @@ export interface InstalledXaiAuth {
  * The plugin sends the token to `api.x.ai/v1` — it deliberately sets no
  * baseURL — so there is no CLI proxy and no client-version header in play.
  *
- * returns null when the env var is absent or malformed; caller treats null as
+ * returns null when the env var is absent or malformed, or when this runner
+ * cannot host it (`resolveDataHome`); caller treats null as
  * "no grok subscription auth, fall through to XAI_API_KEY". */
 export declare function installXaiAuth(): InstalledXaiAuth | null;
 export interface InstalledCodexHome {
@@ -76,3 +78,5 @@ export interface InstalledCodexHome {
  * call. callers treat null as "codex CLI can't use this credential".
  */
 export declare function installCodexHome(): InstalledCodexHome | null;
+/** false for a Codex or Grok subscription on a runner that cannot host it (`resolveDataHome`). */
+export declare function canInstallSubscription(name: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {