pullfrog 0.1.98 → 0.1.99

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.98",
+  version: "0.1.99",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -74,7 +74,7 @@ var package_default = {
     undici: "^7.22.0",
     vitest: "^4.0.17",
     yaml: "^2.8.2",
-    yes: "0.2.3",
+    yes: "0.2.4",
     zod: "4.3.6"
   },
   repository: {
@@ -14358,6 +14358,7 @@ var providers = {
         displayName: "Claude Haiku",
         resolve: "anthropic/claude-haiku-5-5",
         effort: ["low", "medium", "high", "xhigh", "max"],
+        openRouterEffort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-haiku-5.5"
       }
     }
@@ -14513,8 +14514,9 @@ var providers = {
       "grok-4.3": {
         displayName: "Grok 4.3",
         resolve: "xai/grok-4.3",
-        effort: ["none", "low", "medium", "high"],
-        openRouterResolve: "openrouter/x-ai/grok-4.3"
+        effort: ["none", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/x-ai/grok-4.3",
+        openRouterEffort: ["none", "low", "medium", "high"]
       },
       // legacy aliases — xAI retired the entire fast/code-fast line on
       // 2026-05-15 (https://docs.x.ai/developers/migration/may-15-deprecation)
@@ -14561,6 +14563,7 @@ var providers = {
         // models.dev gave the direct id V4.1-Flash's ladder on 2026-09-21, which
         // is what DeepSeek now serves under it — and the same as the Router pin's.
         effort: ["low", "high", "max"],
+        openRouterEffort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813",
         preferred: true
       },
@@ -14580,7 +14583,7 @@ var providers = {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-flash",
         effort: ["low", "high", "max"],
-        openRouterEffort: ["low", "high", "max"],
+        openRouterEffort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4.1-flash"
       },
       // legacy aliases — deepseek retires these on 2026-07-24; transparently
@@ -14610,6 +14613,7 @@ var providers = {
         displayName: "Kimi K3",
         resolve: "moonshotai/kimi-k3",
         effort: ["low", "high", "max"],
+        openRouterEffort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3",
         preferred: true,
         subagentModel: "kimi-k2"
@@ -14778,6 +14782,7 @@ var providers = {
         displayName: "Claude Haiku",
         resolve: "opencode/claude-haiku-5-5",
         effort: ["low", "medium", "high", "xhigh", "max"],
+        openRouterEffort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-haiku-5.5"
       },
       "gpt-sol": {
@@ -14875,7 +14880,7 @@ var providers = {
         resolve: "opencode/kimi-k3",
         // Zen publishes a single rung for K3 where OpenRouter publishes three.
         effort: ["max"],
-        openRouterEffort: ["low", "high", "max"],
+        openRouterEffort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3",
         subagentModel: "kimi-k2"
       },
@@ -14971,7 +14976,11 @@ var providers = {
         effort: ["minimal", "low", "medium", "high", "xhigh"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
-        isFree: true
+        isFree: true,
+        // Zen answers "Model muse-spark-1.3-contributor-free has been deprecated."
+        // since 2026-10-17 and has no free Muse Spark left; stored picks land on
+        // Big Pickle, as `exo` does, rather than on the paid `muse-spark`.
+        fallback: "opencode/big-pickle"
       },
       // Zen's FREE stealth preview (listed 2026-09-16), the big-pickle shape: an
       // anonymous vendor's model at $0 for a limited time. OpenRouter's listing:
@@ -15000,7 +15009,10 @@ var providers = {
         effort: ["low", "medium", "high", "xhigh", "max"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
-        isFree: true
+        isFree: true,
+        // Zen dropped the free id from `/v1/models` and models.dev deprecated it
+        // by 2026-10-19; stored picks land on Big Pickle, as `step-5-preview` does.
+        fallback: "opencode/big-pickle"
       },
       // Zen's FREE Meituan preview (listed 2026-09-25). Zen's docs: zero
       // retention, no training. Go lists the same free id, but one key reaches
@@ -15038,11 +15050,14 @@ var providers = {
         effort: ["high"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
-        isFree: true
+        isFree: true,
+        // Zen answers "Model exo-free has been deprecated." on both lanes since
+        // 2026-10-09; stored picks land on Big Pickle, as `fledge-alpha` does.
+        fallback: "opencode/big-pickle"
       },
       // Zen's FREE StepFun preview (listed 2026-10-08), the seventh promo. Zen's
       // docs: zero retention, no training. Go lists the same free id; one key
-      // reaches both. hidden until a published `pullfrog` resolves it.
+      // reaches both.
       "step-5-preview": {
         displayName: "Step 5 Preview",
         description: "StepFun preview, free for a limited time",
@@ -15051,7 +15066,9 @@ var providers = {
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
         isFree: true,
-        hidden: true
+        // Zen dropped the free id from `/v1/models` and models.dev deprecated it
+        // by 2026-10-15; stored picks land on Big Pickle, as `exo` does.
+        fallback: "opencode/big-pickle"
       },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
@@ -15140,7 +15157,7 @@ var providers = {
         // Go publishes a single rung for K3 where the OpenRouter route
         // publishes three, so every position lands on `max` here.
         effort: ["max"],
-        openRouterEffort: ["low", "high", "max"],
+        openRouterEffort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3",
         subagentModel: "kimi-k2"
       },
@@ -15197,7 +15214,10 @@ var providers = {
       "minimax-m2.5": {
         displayName: "MiniMax M2",
         resolve: "opencode-go/minimax-m2.7",
-        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+        openRouterResolve: "openrouter/minimax/minimax-m2.7",
+        // models.dev deprecated Go's m2.7 by 2026-10-15 and Go lists no other
+        // M2; M3 is the same vendor at the same $0.30 input price.
+        fallback: "opencode-go/minimax-m3"
       },
       // Xiaomi — Go-only; Zen serves the free `mimo-v2-pro-free` promo instead.
       "mimo-pro": {
@@ -15339,7 +15359,7 @@ var providers = {
         resolve: "openrouter/~anthropic/claude-haiku-latest",
         // the rolling alias moved to Haiku 5.5 on 2026-10-07, which publishes
         // the ladder Haiku 4.5 did not.
-        effort: ["low", "medium", "high", "xhigh", "max"],
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/~anthropic/claude-haiku-latest"
       },
       // pinned to the explicit Sol/Terra/Luna tiers (not the ~openai/gpt-latest
@@ -15453,7 +15473,7 @@ var providers = {
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "openrouter/deepseek/deepseek-v4-pro-0813",
-        effort: ["low", "high", "max"],
+        effort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813"
       },
       // the V4.1 id, not the bare one — see `deepseek/deepseek-flash` for why
@@ -15462,7 +15482,7 @@ var providers = {
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "openrouter/deepseek/deepseek-v4.1-flash",
-        effort: ["low", "high", "max"],
+        effort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/deepseek/deepseek-v4.1-flash"
       },
       // legacy alias — deepseek retires this on 2026-07-24; transparently
@@ -15481,7 +15501,7 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         resolve: "openrouter/moonshotai/kimi-k3",
-        effort: ["low", "high", "max"],
+        effort: ["none", "low", "high", "max"],
         openRouterResolve: "openrouter/moonshotai/kimi-k3"
       },
       // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
@@ -15605,17 +15625,17 @@ var providers = {
       "kimi-k3": {
         displayName: "Kimi K3",
         resolve: "vercel/moonshotai/kimi-k3",
-        effort: ["none", "low", "high", "max"]
+        effort: ["low", "high", "max"]
       },
       "muse-spark": {
         displayName: "Muse Spark",
         resolve: "vercel/meta/muse-spark-1.3",
-        effort: ["minimal", "low", "medium", "high", "xhigh"]
+        effort: ["minimal", "low", "medium", "high", "xhigh", "max"]
       },
       "mistral-large": {
         displayName: "Mistral Large",
         resolve: "vercel/mistral/mistral-large-4",
-        effort: ["none", "low", "medium", "high"]
+        effort: ["none", "high"]
       }
     }
   })
@@ -17188,6 +17208,14 @@ var selectedCredentialSchema = external_exports.object({
 function subscriptionLabel(input) {
   return input.email ?? `\u2022\u2022\u2022\u2022 ${input.suffix}`;
 }
+function subscriptionStatusText(subscription) {
+  if (subscription.status === "rejected") return "Rejected";
+  if (subscription.status !== "exhausted") return null;
+  if (!subscription.resetAt) return "Limit reached";
+  const resetAt = new Date(subscription.resetAt);
+  if (resetAt.getTime() <= Date.now()) return null;
+  return `Limit reached \xB7 resets ${resetAt.toLocaleString(void 0, { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" })}`;
+}
 
 // utils/xaiOAuth.ts
 var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
@@ -17529,6 +17557,7 @@ export {
   subscriptionListSchema,
   subscriptionNameSchema,
   subscriptionSchema,
+  subscriptionStatusText,
   truncateAtLineBoundary,
   updateProgressComment,
   verifyCredential

package/dist/mcp/shell.d.ts

@@ -32,6 +32,7 @@ export declare function runSandboxed(params: {
     env: Record<string, string | undefined>;
     cwd: string;
     timeout: number;
+    seal: boolean;
     /** live-stream chunks as they arrive, on top of the buffered `output`.
      * lifecycle hooks use this to keep a long `pnpm test` visible in the
      * workflow log instead of silent until it exits. */

package/dist/utils/codexOAuth.d.ts

@@ -34,7 +34,7 @@ export interface CodexAuthBody {
     refresh_rejected_at?: string;
 }
 /** OAuth client id Codex CLI and OpenCode both use against `auth.openai.com`.
- * Same chain — a refresh token minted via `codex login --device-auth` can be
+ * Same chain — a refresh token minted via `codex login` can be
  * refreshed against this client_id. */
 export declare const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";

package/dist/utils/github.d.ts

@@ -75,7 +75,7 @@ export declare function fetchIdTokenFromStash(creds: OidcCredentials): Promise<s
  * own retry still re-mints. Mid-run refreshes take the stashed-credentials path
  * (`opts.oidc`) and deliberately bypass this.
  */
-export declare const mintIdToken: (() => Promise<string>) & yes.CacheMethods<undefined, undefined>;
+export declare const mintIdToken: (() => Promise<string>) & yes.AttemptMethod<[], string> & yes.CacheMethods<undefined, undefined, () => Promise<string>>;
 /**
  * ensure a GitHub token is available in the environment.
  *

package/dist/utils/subscriptionCredentials.d.ts

@@ -88,3 +88,5 @@ export declare function subscriptionLabel(input: {
     email: string | null;
     suffix: string;
 }): string;
+/** the provider's last verdict on a subscription, or null when it last worked. */
+export declare function subscriptionStatusText(subscription: Subscription): string | null;

package/dist/utils/vercelBypass.d.ts

@@ -0,0 +1,6 @@
+/**
+ * the Vercel protection-bypass secret for a request to `url`, if it should carry one. only
+ * Pullfrog preview deployments sit behind deployment protection, and the env var is Vercel's
+ * own name, so a workflow may hold a different project's secret: it never goes anywhere else.
+ */
+export declare function vercelBypassSecretFor(url: URL): string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.98",
+  "version": "0.1.99",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {
@@ -66,7 +66,7 @@
     "undici": "^7.22.0",
     "vitest": "^4.0.17",
     "yaml": "^2.8.2",
-    "yes": "0.2.3",
+    "yes": "0.2.4",
     "zod": "4.3.6"
   },
   "repository": {