pullfrog 0.1.100 → 0.1.101

package/dist/utils/runErrorRenderer.d.ts

@@ -1,99 +1,67 @@
 /**
- * Classify + render the error thrown out of the main run try-block into a
- * pair of user-facing markdown bodies — one for the GitHub Actions job
- * summary tab, one for the PR progress comment.
+ * Classify + render the error thrown out of the main run try-block into the
+ * markdown the user reads — the PR progress comment, and the same body under a
+ * `### ❌ Pullfrog failed` banner in the GitHub Actions job summary.
  *
- * Classifications, in dispatch order (first match wins; the api-key
- * branch additionally folds in the activity-timeout hang body as a
- * sub-source so a hang masking an api-key error still surfaces the api-key
- * CTA):
+ * Every body names its cause, so none collapses to a bare "Run failed.": an
+ * error nothing below recognizes is shown as-is under "An unrecognized error
+ * occurred." The shape is `renderFailure`'s, so the copy rules hold for all of
+ * them — see `failureBody.ts`.
  *
- *   1. `BillingError` — either the proxy-token mint already threw one (402
- *      handled inline) or the agent runtime surfaced an OpenRouter
- *      "key budget exhausted" string mid-run. Both render via
- *      `formatBillingErrorSummary` so the user sees actionable copy.
+ * Classifications, in dispatch order (first match wins):
  *
- *   1a. Pre-rendered bodies — a throw site that already built the markdown
+ *   1. Trial credits — a trial key that ran out mid-run is the account's free
+ *      credits running out, never the Router wallet the same wire text means
+ *      on a Router run.
+ *
+ *   1a. `BillingError` — the agent runtime surfaced an OpenRouter "key budget
+ *      exhausted" string mid-run on a Router run. Same copy as a proxy-token 402.
+ *
+ *   1b. Pre-rendered bodies — a throw site that already built the markdown
  *      (`MODEL_ACCESS_MARKER`, `SECRETS_UNAVAILABLE_MARKER`,
- *      `ROUTER_UNFUNDED_MARKER`, `CREDENTIAL_REJECTED_MARKER`,
- *      `CREDENTIAL_POOL_REFUSED_MARKER`) passes through verbatim on both surfaces.
+ *      `ROUTER_UNFUNDED_MARKER`, `TRIAL_SPENT_MARKER`,
+ *      `CREDENTIAL_REJECTED_MARKER`, `CREDENTIAL_POOL_REFUSED_MARKER`) passes
+ *      through verbatim.
  *
  *   2. BYOK provider billing-exhausted (#835) — DeepSeek "Insufficient
  *      Balance", Anthropic "credit balance is too low", OpenCode Zen
- *      `CreditsError`, Gemini "spending cap". Checked before api-key auth
- *      because billing-exhausted responses often carry 401 status codes
- *      that `isApiKeyAuthError` would otherwise mis-classify.
+ *      `CreditsError`, Gemini "spending cap", a ChatGPT workspace out of
+ *      credits. Checked before api-key auth because billing-exhausted responses
+ *      often carry 401 status codes that `isApiKeyAuthError` would otherwise
+ *      mis-classify.
  *
  *   2a. Provider usage limit (#1474) — a capped subscription window or a
  *      configured workspace limit; "wait or raise it", never "top up".
  *
  *   3. API-key auth error — `isApiKeyAuthError` sniffs the raw error string
  *      (or the activity-timeout hang body when present, since that's where
- *      the underlying provider error often lands); `formatApiKeyErrorSummary`
- *      renders provider + console-link copy.
- *
- *   4. ProviderModelNotFoundError — configured model id not in the OpenCode
- *      catalog (opencode ≥1.18 words it `Model not found: <id>`, #1470);
- *      renders a nudge to pick a different model.
- *
- *   4a. No-provider-available (#1077) — the model IS in the catalog but the
- *      provider declines to route it on this account's plan (OpenCode Zen's
- *      own refusal string). Same "pick another model" CTA, different reason.
+ *      the underlying provider error often lands).
  *
- *   4a'. Zen free-tier gate (#1377) — Zen 403s a free-tier request whose tool
- *      list is missing a built-in it expects. The harness keeps `bash` listed,
- *      but opencode's auto-compaction request carries no tools, so a long
- *      free-Zen run can still die mid-flight on the raw upstream string.
- *
- *   4b. Context-window overflow (#1116) — terminal `Prompt is too long` /
- *      `maximum context length is N tokens`. Actionable, so it renders on
- *      both surfaces rather than collapsing to the one-line comment.
- *
- *   4b'. Run time limit — the agent was still working when the run's own
- *      timeout fired. Actionable (raise the limit), so both surfaces.
+ *   4. Model not in OpenCode's catalog (opencode ≥1.18 words it `Model not
+ *      found: <id>`, #1470), a provider declining the model (#1077), Zen's
+ *      free-tier gate (#1377), context overflow (#1116), the run's time limit,
+ *      the repo's stop script, and an agent that never posted its review.
  *
  *   4c. Transient upstream failure (#1173) — Anthropic `529 Overloaded`,
  *      OpenRouter `provider_unavailable` / `timeout`, Zen `Streaming response
- *      failed: [5xx]`. Last of the classified branches so every more specific
- *      one wins first. Renders on both surfaces: the remedy is re-triggering,
- *      which the user can only know if we say so.
+ *      failed: [5xx]`, Codex's model at capacity. Last of the classified
+ *      branches so every more specific one wins first.
  *
- *   5. Activity-timeout hang — `errorMessage` starts with
- *      `"activity timeout"` or `"agent still pending"` AND none of the
- *      above matched. The harness keeps structured diagnostic state on
- *      `toolState.agentDiagnostic`; `formatAgentHangBody` renders that into
- *      the job summary. The PR comment keeps that same body whenever the hang
- *      is EXPLAINED — a classified provider error (#778, #1183) or a provider
- *      that never returned a first token — and otherwise collapses to a
- *      one-line `**Run failed.** [View the logs →]`, because watchdog jargon,
- *      event counts and a benign stderr tail are operator-grade detail that
- *      only alarm the average user.
+ *   5. Activity-timeout hang — `formatAgentHangBody` says whose side went
+ *      quiet, with the agent's last output collapsed under it.
  *
  *   6. Unclassified provider error (#1474) — `errorMessage` starts with
- *      `provider error: `. opencode prefixes every provider-side turn failure
- *      with the provider's text; claude-code (a zero-event exit) and codex (no
- *      turn error, no stderr) prefix only our classifier label. Either names
- *      something the user can act on, so both surfaces get a lead line plus the
- *      raw text in a fenced block.
+ *      `provider error: `: the provider's own text, shown under a lead line.
  *
- *   7. Default — the job summary gets a plain-English lead sentence plus the
- *      raw error in a fenced code block under the `### ❌ Pullfrog failed`
- *      banner; the PR comment collapses to the same one-line logs link as
- *      the hang case, since the raw internal string helps nobody on the PR.
- *
- * Net: the actionable classifications (billing, usage limit, API-key,
- * model-not-found, no-provider-available, context-overflow, run time limit,
- * transient-upstream, unclassified provider error) render identical bodies on
- * both surfaces; the non-actionable ones (unexplained hang, generic) keep the
- * forensics in the Actions job summary and show a calm one-liner in the PR
- * comment, whose footer already carries Pullfrog branding + rerun links.
+ *   7. Default — "An unrecognized error occurred." over the error itself.
  */
+import type { AgentCredential } from "../agents/shared.ts";
 import type { AgentDiagnostic } from "./agentHangReport.ts";
 export type RenderedRunError = {
     summary: string;
     comment: string;
 };
-export declare function renderRunError(input: {
+type RenderRunErrorInput = {
     errorMessage: string;
     repo: {
         owner: string;
@@ -104,4 +72,11 @@ export declare function renderRunError(input: {
      * the user's own provider credential. `payload.proxyModel` at both call
      * sites. */
     routerActive: boolean;
-}): RenderedRunError;
+    /** the model that ran: it names the provider, and the subscription when one is in play. */
+    model?: string | undefined;
+    credential?: AgentCredential | undefined;
+    /** the run was served by the account's free trial credits. */
+    trial?: boolean | undefined;
+};
+export declare function renderRunError(input: RenderRunErrorInput): RenderedRunError;
+export {};

package/dist/utils/secretCommands.d.ts

@@ -1,19 +1,10 @@
+export declare function maskSecret(value: string): void;
 /**
- * `@actions/core` workflow commands that carry a credential, gated on actually
- * running under a runner.
- *
- * Off a runner nothing consumes these commands and `@actions/core` writes the
- * raw value to stdout instead — `setSecret` always, `saveState` / `setOutput`
- * whenever `GITHUB_STATE` / `GITHUB_OUTPUT` are unset. That is a plaintext
- * credential on whatever terminal is running the action, which is how an OpenAI
- * key reached local Codex transcripts and was disabled (2026-09).
- *
- * Route every credential-bearing call through here instead of calling `core`
- * directly — `nub run check:secret-commands` enforces it. Non-credential output
- * (the agent's own `result` text) stays ungated, because the test harness reads
- * it back through `GITHUB_OUTPUT` on a host with no runner.
+ * Every value `maskSecret` registered, replaced in `text` as the runner would in
+ * a log: whole, then line by line. Parts under 8 characters are skipped, or the
+ * `{` and `}` lines of a JSON key would blank every brace in the comment.
  */
-export declare function maskSecret(value: string): void;
+export declare function redactSecrets(text: string): string;
 /** @see maskSecret — same gate, for state the `post:` hook reads back. */
 export declare function saveSecretState(name: string, value: string): void;
 /** @see maskSecret — same gate, for a step output carrying a credential. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.100",
+  "version": "0.1.101",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {