pullfrog 0.1.15 → 0.1.17

package/dist/internal/index.d.ts

@@ -3,7 +3,7 @@
  * Re-exports shared types, values, and utilities needed by the Next.js app.
  */
 export type { AuthorPermission, ModelAlias, ModelProvider, Payload, PayloadEvent, ProviderConfig, PushPermission, ShellPermission, ToolPermission, WriteablePayload, } from "../external.ts";
-export { DEFAULT_PROXY_MODEL, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, modelAliases, parseModel, providers, pullfrogMcpName, resolveCliModel, resolveDisplayAlias, resolveModelSlug, resolveOpenRouterModel, } from "../external.ts";
+export { DEFAULT_PROXY_MODEL, getAutoSelectHintModel, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, modelAliases, parseModel, providers, pullfrogMcpName, resolveCliModel, resolveDisplayAlias, resolveModelSlug, resolveOpenRouterModel, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export type { BuildPullfrogFooterParams, WorkflowRunFooterInfo, } from "../utils/buildPullfrogFooter.ts";

package/dist/internal.js

@@ -11,8 +11,8 @@ var providers = {
     models: {
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "anthropic/claude-opus-4-7",
-        openRouterResolve: "openrouter/anthropic/claude-opus-4.7",
+        resolve: "anthropic/claude-opus-4-8",
+        openRouterResolve: "openrouter/anthropic/claude-opus-4.8",
         preferred: true,
         subagentModel: "claude-sonnet"
       },
@@ -190,8 +190,8 @@ var providers = {
       },
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "opencode/claude-opus-4-7",
-        openRouterResolve: "openrouter/anthropic/claude-opus-4.7",
+        resolve: "opencode/claude-opus-4-8",
+        openRouterResolve: "openrouter/anthropic/claude-opus-4.8",
         subagentModel: "claude-sonnet"
       },
       "claude-sonnet": {
@@ -323,8 +323,8 @@ var providers = {
     models: {
       "claude-opus": {
         displayName: "Claude Opus",
-        resolve: "openrouter/anthropic/claude-opus-4.7",
-        openRouterResolve: "openrouter/anthropic/claude-opus-4.7",
+        resolve: "openrouter/anthropic/claude-opus-4.8",
+        openRouterResolve: "openrouter/anthropic/claude-opus-4.8",
         preferred: true,
         subagentModel: "claude-sonnet"
       },
@@ -481,6 +481,16 @@ if (!defaultProxyAlias?.openRouterResolve) {
   throw new Error("DEFAULT_PROXY_MODEL: moonshotai/kimi-k2 missing openRouterResolve");
 }
 var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
+function getAutoSelectHintModel() {
+  const alias = defaultProxyAlias;
+  if (!alias) return "Kimi 2.6";
+  const modelId = alias.resolve.split("/")[1] ?? "kimi-k2.6";
+  const version = modelId.replace(/^kimi-k2\./, "");
+  if (version && version !== modelId) {
+    return `Kimi 2.${version}`;
+  }
+  return alias.displayName;
+}
 function resolveModelSlug(slug) {
   return modelAliases.find((a) => a.slug === slug)?.resolve;
 }
@@ -704,7 +714,7 @@ function computeModes(agentId) {
 
    Otherwise delegate the \`${REVIEWER_AGENT_NAME}\` subagent to review your diff with fresh eyes against YOUR TASK. The subagent's baked-in system prompt enforces a non-mutative + non-recursive contract: read-only file/search/web tools and read-only MCP queries only; no writes, shell side effects, state-changing MCP calls, or nested subagent dispatch. Enforcement is prose-only \u2014 restate the constraint in your dispatch instructions and do not relax it.
 
-   Before dispatching, ensure \`origin/<base>\` is locally available \u2014 the runner is often a shallow single-branch \`actions/checkout\` (depth=1, head-only refspec), and the reviewer's \`git diff --merge-base origin/<base>\` will fail with \`ambiguous argument\` or \`no merge base\` otherwise. Run \`git fetch --no-tags --deepen=1000 origin <base>\` once; it's a no-op if the ref already has enough history. (The reviewer is read-only by contract, so it cannot do this itself \u2014 fetching is the orchestrator's job.)
+   Before dispatching, ensure \`origin/<base>\` is locally available \u2014 the runner is often a shallow single-branch \`actions/checkout\` (depth=1, head-only refspec), and the reviewer's \`git diff --merge-base origin/<base>\` will fail with \`ambiguous argument\` or \`no merge base\` otherwise. Run \`git fetch --no-tags --deepen=1000 origin <base>:refs/remotes/origin/<base>\` once (the explicit destination refspec is required \u2014 a shallow single-branch checkout configures a head-only refspec, so a bare \`origin <base>\` only updates \`FETCH_HEAD\` and never creates the \`origin/<base>\` tracking ref); it's a no-op if the ref already has enough history. (The reviewer is read-only by contract, so it cannot do this itself \u2014 fetching is the orchestrator's job.)
 
    Compose your \`${REVIEWER_AGENT_NAME}\` dispatch prompt using this template verbatim, substituting the \`<...>\` placeholders. The preamble aligns the orchestrator side of the dispatch contract with the reviewer's baked-in system prompt \u2014 both ends say the same thing about where the work lives and what to do on an empty diff.
 
@@ -1087,7 +1097,7 @@ ${PR_SUMMARY_FORMAT}`
 
 1. **task list**: create your task list for this run as your first action.
 
-2. Analyze the task. For simple operations (labeling, commenting, answering questions, running a single command), handle directly.
+2. Analyze the task. For simple operations (labeling, commenting, answering questions, running a single command), handle directly \u2014 but your answer only reaches the user through \`${t("report_progress")}\` (step 4); raw assistant text is discarded.
 
 3. For substantial work \u2014 code changes across multiple files, multi-step investigations:
    - plan your approach before starting
@@ -1389,6 +1399,7 @@ export {
   createLeapingProgressComment,
   decodeJwtExpMs,
   deleteProgressCommentApi,
+  getAutoSelectHintModel,
   getModelEnvVars,
   getModelManagedCredentials,
   getModelProvider,

package/dist/mcp/comment.d.ts

@@ -38,7 +38,8 @@ export declare const ReportProgress: import("arktype/internal/variants/object.ts
  *   - object:    active comment — will update it in place via the right REST endpoint for its type
  *   - null:      deliberately deleted (e.g. after submitting a PR review) — skips silently
  *
- * The body is always tracked in lastProgressBody for the job summary regardless of comment state.
+ * The body is tracked in lastProgressBody for the job summary regardless of comment state,
+ * EXCEPT for `liveProgress` (todo-tracker) writes — see the param note below.
  *
  * The "existing plan comment" path always targets a top-level issue comment (plan comments are
  * created by create_issue_comment with type:"Plan", never as review-thread replies).
@@ -46,6 +47,7 @@ export declare const ReportProgress: import("arktype/internal/variants/object.ts
 export declare function reportProgress(ctx: ToolContext, params: {
     body: string;
     target_plan_comment?: boolean;
+    liveProgress?: boolean;
 }): Promise<{
     commentId?: number;
     url?: string;

package/dist/mcp/reviewComments.d.ts

@@ -1,9 +1,10 @@
 import type { Octokit } from "@octokit/rest";
 import type { ToolContext } from "./server.ts";
-export declare const REVIEW_THREADS_QUERY = "\nquery ($owner: String!, $name: String!, $prNumber: Int!) {\n  repository(owner: $owner, name: $name) {\n    pullRequest(number: $prNumber) {\n      reviewThreads(first: 100) {\n        nodes {\n          id\n          path\n          line\n          startLine\n          diffSide\n          isResolved\n          isOutdated\n          comments(first: 50) {\n            nodes {\n              fullDatabaseId\n              body\n              createdAt\n              diffHunk\n              line\n              startLine\n              originalLine\n              originalStartLine\n              author { login }\n              pullRequestReview {\n                databaseId\n                author { login }\n              }\n              reactionGroups {\n                content\n                reactors(first: 10) {\n                  nodes {\n                    ... on Actor { login }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n";
+export declare const REVIEW_THREADS_QUERY = "\nquery ($owner: String!, $name: String!, $prNumber: Int!) {\n  repository(owner: $owner, name: $name) {\n    pullRequest(number: $prNumber) {\n      reviewThreads(first: 100) {\n        nodes {\n          id\n          path\n          line\n          startLine\n          diffSide\n          isResolved\n          isOutdated\n          comments(first: 50) {\n            nodes {\n              fullDatabaseId\n              body\n              bodyHTML\n              createdAt\n              diffHunk\n              line\n              startLine\n              originalLine\n              originalStartLine\n              author { login }\n              pullRequestReview {\n                databaseId\n                author { login }\n              }\n              reactionGroups {\n                content\n                reactors(first: 10) {\n                  nodes {\n                    ... on Actor { login }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n";
 export type ReviewThreadComment = {
     fullDatabaseId: string | null;
     body: string;
+    bodyHTML: string;
     createdAt: string;
     diffHunk: string;
     line: number | null;
@@ -96,6 +97,8 @@ interface GetReviewDataInput {
     pullNumber: number;
     reviewId: number;
     approvedBy?: string | undefined;
+    tmpdir: string;
+    githubToken: string;
 }
 export interface FormatReviewDataInput {
     review: ReviewResponse;

package/dist/models.d.ts

@@ -104,6 +104,8 @@ export declare function getModelEnvVars(slug: string): string[];
 export declare function getModelManagedCredentials(slug: string): string[];
 export declare const modelAliases: ModelAlias[];
 export declare const DEFAULT_PROXY_MODEL: string;
+/** short label for the model auto-select picks today (console hint copy). */
+export declare function getAutoSelectHintModel(): string;
 /** resolve a model slug to its concrete models.dev specifier (e.g. "anthropic/claude-opus-4-6") */
 export declare function resolveModelSlug(slug: string): string | undefined;
 /**

package/dist/prep/types.d.ts

@@ -20,6 +20,8 @@ export type PrepResult = NodePrepResult | PythonPrepResult | UnknownLanguagePrep
 export type PrepOptions = {
     /** when true, lifecycle scripts (postinstall, etc.) are suppressed */
     ignoreScripts: boolean;
+    /** directory the corepack shim is installed into (see `packageManagerBinDir`) */
+    binDir: string;
 };
 export interface PrepDefinition {
     name: string;

package/dist/utils/assets.d.ts

@@ -0,0 +1,8 @@
+/**
+ * downloads any github-hosted image/video assets referenced in `markdown` to
+ * `<tmpdir>/assets` and rewrites the urls to the local file paths, so the agent can
+ * read screenshots directly instead of relying on remote (often short-lived, signed)
+ * urls. unique urls are downloaded once and every occurrence is rewritten. assets that
+ * fail to download are left untouched.
+ */
+export declare function downloadAssetsInMarkdown(markdown: string, tmpdir: string, githubToken: string): Promise<string>;

package/dist/utils/body.d.ts

@@ -5,6 +5,8 @@ interface ResolveBodyContext {
     event: PayloadEvent;
     octokit: OctokitWithPlugins;
     repo: RunContextData["repo"];
+    tmpdir: string;
+    githubToken: string;
 }
 /**
  * resolves the body of an event by fetching body_html and converting to markdown.
@@ -13,4 +15,20 @@ interface ResolveBodyContext {
  * broken user-attachments URLs.
  */
 export declare function resolveBody(ctx: ResolveBodyContext): Promise<string | null>;
+interface ResolveBodyAssetsContext {
+    body: string | null | undefined;
+    bodyHtml: string | null | undefined;
+    tmpdir: string;
+    githubToken: string;
+}
+/**
+ * downloads github-hosted image assets in a body to disk and rewrites the urls to local
+ * paths so the agent can read them. when the body has images and a rendered `bodyHtml`
+ * is supplied, the html is turndowned first: github only exposes attachments as signed,
+ * self-authenticating `*.githubusercontent.com` urls through body_html — the raw
+ * `github.com/user-attachments/...` urls in unrendered markdown 404 for the installation
+ * token. callers that fetch a body should request it with the `application/vnd.github.full+json`
+ * media type and pass `body_html` here.
+ */
+export declare function resolveBodyAssets(ctx: ResolveBodyAssetsContext): Promise<string | null>;
 export {};

package/dist/utils/instructions.d.ts

@@ -17,6 +17,10 @@ interface InstructionsContext {
      * inline into the LEARNINGS prompt section so the agent can `read_file`
      * targeted line ranges instead of pulling the whole file into context. */
     learningsHeadings: LearningsHeading[];
+    /** agent-facing description of a setup lifecycle hook failure (see
+     * `describeSetupFailure`), rendered as a SETUP HOOK FAILED banner. empty
+     * string when the hook succeeded, was skipped, or wasn't configured. */
+    setupHookFailure: string;
 }
 export interface ResolvedInstructions {
     full: string;

package/dist/utils/lifecycle.d.ts

@@ -26,6 +26,10 @@ export type LifecycleHookFailure = {
     kind: "spawn";
     spawnError: string;
 };
+/** one-line, agent-facing description of a hook failure. empty string when
+ * there was no failure, so callers can pass the result straight through to a
+ * prompt section that omits itself on empty. */
+export declare function describeSetupFailure(failure: LifecycleHookFailure | undefined): string;
 export interface LifecycleHookResult {
     /**
      * human-readable warning when the hook failed. includes retry guidance:
@@ -46,8 +50,8 @@ export interface LifecycleHookResult {
  * execute a lifecycle hook script if one is configured.
  *
  * soft-fails: instead of throwing on hook errors, returns a warning string
- * (and structured failure info) so callers can choose whether to surface
- * it (mcp tools) or upgrade it to a fatal error (setup). timeouts are
- * flagged as non-retryable in the warning text.
+ * (and structured failure info) so callers can choose how to surface it
+ * (mcp tools relay it to the agent; setup logs it and adds a prompt banner).
+ * timeouts are flagged as non-retryable in the warning text.
  */
 export declare function executeLifecycleHook(params: ExecuteLifecycleHookParams): Promise<LifecycleHookResult>;

package/dist/utils/packageManager.d.ts

@@ -18,6 +18,18 @@ export interface PackageManagerSpec {
  * we warn on disagreement and stick with `devEngines`.
  */
 export declare function resolvePackageManagerSpec(cwd: string): Promise<PackageManagerSpec | null>;
+/** the per-run directory the corepack shim is installed into. deliberately
+ * NOT the node bin dir: that's npm's `-g` target, and a corepack shim sitting
+ * there makes a customer setup script's `npm i -g pnpm` abort with EEXIST
+ * (npm refuses to clobber a binary it doesn't own). lives under the run
+ * tmpdir so it's cleaned up with everything else. */
+export declare function packageManagerBinDir(tmpdir: string): string;
+export interface EnsurePackageManagerParams {
+    spec: PackageManagerSpec;
+    /** directory to install the corepack shim into (see `packageManagerBinDir`).
+     * prepended to PATH so the pinned binary resolves by name. */
+    binDir: string;
+}
 /**
  * ensure the requested package manager is on PATH at the declared version,
  * provisioning via corepack when applicable. returns true if PATH now
@@ -25,8 +37,13 @@ export declare function resolvePackageManagerSpec(cwd: string): Promise<PackageM
  * the caller should treat PATH as untrusted and may fall back to its
  * legacy install path).
  *
+ * the corepack shim is installed into `params.binDir` (prepended to PATH),
+ * not the node bin dir, so a later `npm i -g pnpm` in a setup hook can't
+ * collide with it. our dir wins the PATH lookup, so the pinned version is
+ * also what resolves even if that `npm i -g` succeeds into the node bin dir.
+ *
  * never throws: network failure, missing corepack, range-only versions —
  * all degrade to "log warning, return false". the existing PATH binary
  * still works; we just don't get our version guarantee.
  */
-export declare function ensurePackageManager(spec: PackageManagerSpec): Promise<boolean>;
+export declare function ensurePackageManager(params: EnsurePackageManagerParams): Promise<boolean>;

package/dist/utils/run.d.ts

@@ -1,9 +1,9 @@
 import type { AgentResult } from "../agents/shared.ts";
 import type { MainResult } from "../main.ts";
-import type { ToolState } from "../toolState.ts";
+import type { ToolContext } from "../mcp/server.ts";
 export interface HandleAgentResultParams {
     result: AgentResult;
-    toolState: ToolState;
+    toolContext: ToolContext;
     silent: boolean | undefined;
 }
 export declare function handleAgentResult(ctx: HandleAgentResultParams): Promise<MainResult>;

package/dist/utils/runErrorRenderer.d.ts

@@ -33,8 +33,10 @@
  *      `toolState.agentDiagnostic`; `formatAgentHangBody` renders that as
  *      a markdown block.
  *
- *   6. Default — a generic `❌ Pullfrog failed` block with the raw error
- *      message in a fenced code block. Same body for both surfaces.
+ *   6. Default — a plain-English lead sentence explaining the run failed,
+ *      followed by the raw error message in a fenced code block (so the user
+ *      never sees a bare internal string). The job summary adds the
+ *      `### ❌ Pullfrog failed` banner on top of the same body.
  *
  * The hang body and the API-key body diverge between the two surfaces only
  * in that the job summary wraps them in the `### ❌ Pullfrog failed` H3

package/dist/utils/runLifecycle.d.ts

@@ -46,11 +46,12 @@ export declare function persistRunArtifacts(toolContext: ToolContext): Promise<v
  *      prepended below in step 4) — same classifier as the catch path so
  *      the user sees it instead of a deleted-comment void / empty summary
  *      tab
- *   3. when the run succeeded and the progress comment was never finalized
- *      via `report_progress`, delete it (three sub-cases — orphan
- *      "Leaping into action" comment, abandoned checklist, agent wrote
- *      a substantive artifact via another MCP write tool but skipped
- *      report_progress)
+ *   3. when the run succeeded, some write landed (`wasUpdated`), but the
+ *      progress comment was never finalized via `report_progress`, delete
+ *      the stranded comment (abandoned checklist, or a substantive artifact
+ *      written via another MCP write tool that skipped report_progress). a
+ *      run where NO write landed keeps its comment for handleAgentResult to
+ *      salvage into — see the `wasUpdated` guard below and #868
  *   4. write the GitHub Actions step summary (best-effort — a write
  *      failure must not throw past this point because we'd hit the outer
  *      catch and clobber any progress comment we just wrote)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@actions/core": "^1.11.1",
-    "@anthropic-ai/claude-code": "2.1.112",
+    "@anthropic-ai/claude-code": "2.1.150",
     "@ark/fs": "0.56.0",
     "@ark/util": "0.56.0",
     "@clack/prompts": "^1.2.0",
@@ -51,7 +51,7 @@
     "fastmcp": "^3.34.0",
     "file-type": "^21.3.0",
     "husky": "^9.0.0",
-    "opencode-ai": "1.15.1",
+    "opencode-ai": "1.15.13",
     "package-manager-detector": "^1.6.0",
     "picocolors": "^1.1.1",
     "semver": "^7.7.3",
@@ -59,6 +59,7 @@
     "table": "^6.9.0",
     "turndown": "^7.2.0",
     "typescript": "^5.9.3",
+    "undici": "^7.22.0",
     "vitest": "^4.0.17",
     "yaml": "^2.8.2"
   },