pullfrog 0.1.33 → 0.1.34

package/dist/index.js

@@ -101041,7 +101041,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.33",
+  version: "0.1.34",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -163558,6 +163558,11 @@ async function mintProxyKey(ctx) {
         body?.error ?? "billing service temporarily unavailable \u2014 retry shortly"
       );
     }
+    if (response.status === 404) {
+      throw new TransientError(
+        "Pullfrog couldn't match this repository to its account \u2014 it may have just been renamed or transferred. The link refreshes automatically on the next run; if it keeps failing, reinstall the GitHub App on the repo's current owner."
+      );
+    }
     if (!response.ok) {
       log.warning(`proxy key mint failed (${response.status})`);
       return null;
@@ -164122,28 +164127,7 @@ ${genericBody}`,
 // utils/runLifecycle.ts
 var core10 = __toESM(require_core(), 1);
 
-// utils/checksGate.ts
-var OK_CONCLUSIONS = /* @__PURE__ */ new Set(["success", "neutral", "skipped"]);
-var PULLFROG_CHECKS = /* @__PURE__ */ new Set(["pullfrog", "pullfrog-approval"]);
-function checkRunsGate(params) {
-  for (const run of params.checkRuns) {
-    if (PULLFROG_CHECKS.has(run.name.toLowerCase())) continue;
-    if (run.status !== "completed")
-      return { ok: false, reason: `check "${run.name}" ${run.status}` };
-    if (!OK_CONCLUSIONS.has(run.conclusion ?? "")) {
-      return { ok: false, reason: `check "${run.name}" concluded ${run.conclusion}` };
-    }
-  }
-  return { ok: true, reason: "all checks passed" };
-}
-function hasVerifiedCheck(params) {
-  return params.checkRuns.some(
-    (r) => !PULLFROG_CHECKS.has(r.name.toLowerCase()) && r.status === "completed"
-  );
-}
-
 // utils/autoMerge.ts
-var NON_MERGEABLE_STATES = /* @__PURE__ */ new Set(["dirty", "behind", "blocked"]);
 function hasBlockingHumanReview(reviews) {
   const latestByReviewer = /* @__PURE__ */ new Map();
   for (const review of reviews) {
@@ -164160,6 +164144,20 @@ function hasBlockingHumanReview(reviews) {
   }
   return false;
 }
+var ENABLE_AUTO_MERGE = (
+  /* GraphQL */
+  `
+  mutation ($pullRequestId: ID!, $headSha: GitObjectID!) {
+    enablePullRequestAutoMerge(input: {
+      pullRequestId: $pullRequestId
+      mergeMethod: SQUASH
+      expectedHeadOid: $headSha
+    }) { clientMutationId }
+  }`
+);
+var isAlreadyMergeable = (error49) => error49 instanceof Error && /clean status/i.test(error49.message);
+var isHeadChanged = (error49) => error49 instanceof Error && /head has changed|expected head/i.test(error49.message);
+var isAutoMergeDisallowed = (error49) => error49 instanceof Error && /not allowed/i.test(error49.message);
 async function autoMergeAfterApprove(ctx) {
   if (!ctx.autoMergeEnabled) return;
   if (!ctx.prApproveEnabled) return;
@@ -164170,6 +164168,12 @@ async function autoMergeAfterApprove(ctx) {
   const skip = (reason) => log.info(
     `autoMerge: pr=#${pullNumber} approvalSha=${approval.sha?.slice(0, 7)} \u2192 skipped: ${reason}`
   );
+  const comment = (body) => ctx.octokit.rest.issues.createComment({
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    issue_number: pullNumber,
+    body: addFooter(ctx, body)
+  }).catch((err) => log.debug(`autoMerge comment failed: ${err}`));
   const pr = await ctx.octokit.rest.pulls.get({
     owner: ctx.repo.owner,
     repo: ctx.repo.name,
@@ -164177,6 +164181,7 @@ async function autoMergeAfterApprove(ctx) {
   });
   if (pr.data.state !== "open") return skip("pr not open");
   if (pr.data.draft) return skip("pr is draft");
+  if (pr.data.auto_merge) return skip("auto-merge already enabled");
   const headSha = pr.data.head.sha;
   if (approval.sha !== headSha) return skip(`approval sha != head ${headSha.slice(0, 7)}`);
   const outstanding = await countOutstandingPullfrogThreads(ctx, pullNumber);
@@ -164188,40 +164193,49 @@ async function autoMergeAfterApprove(ctx) {
     per_page: 100
   });
   if (hasBlockingHumanReview(reviews)) return skip("human changes requested");
-  if (pr.data.mergeable !== true) return skip(`not mergeable (mergeable=${pr.data.mergeable})`);
-  if (pr.data.mergeable_state && NON_MERGEABLE_STATES.has(pr.data.mergeable_state)) {
-    return skip(`mergeable_state=${pr.data.mergeable_state}`);
+  try {
+    await op(
+      () => ctx.octokit.graphql(ENABLE_AUTO_MERGE, {
+        pullRequestId: pr.data.node_id,
+        headSha
+      }),
+      {
+        name: "enablePullRequestAutoMerge",
+        retries: [500, 2e3],
+        bail: (error49) => !isTransientOctokitError(error49)
+      }
+    )();
+    log.info(`autoMerge: pr=#${pullNumber} @ ${headSha.slice(0, 7)} \u2192 native auto-merge enabled`);
+    await comment(
+      "> \u2705 Approved \u2014 auto-merge enabled; GitHub will merge once required checks pass."
+    );
+    return;
+  } catch (error49) {
+    if (isHeadChanged(error49)) return skip("head moved during enable");
+    if (isAutoMergeDisallowed(error49)) {
+      await comment(
+        "> \u26A0\uFE0F Approved, but auto-merge is off for this repo. Enable `Allow auto-merge` in Settings > General > Pull Requests."
+      );
+      return;
+    }
+    if (!isAlreadyMergeable(error49)) throw error49;
   }
-  const checkRuns = await ctx.octokit.paginate(ctx.octokit.rest.checks.listForRef, {
-    owner: ctx.repo.owner,
-    repo: ctx.repo.name,
-    ref: headSha,
-    per_page: 100
-  });
-  const gate = checkRunsGate({ checkRuns });
-  if (!gate.ok) return skip(`ci: ${gate.reason}`);
-  if (!hasVerifiedCheck({ checkRuns })) return skip("no completed external check-run to verify");
+  const base = await ctx.octokit.rest.repos.getBranch({ owner: ctx.repo.owner, repo: ctx.repo.name, branch: pr.data.base.ref }).catch(() => null);
+  if (!base?.data.protected) return skip("base branch not protected \u2014 refusing CI-ungated merge");
   const merge4 = await ctx.octokit.rest.pulls.merge({
     owner: ctx.repo.owner,
     repo: ctx.repo.name,
     pull_number: pullNumber,
     sha: headSha,
     merge_method: "squash",
-    commit_title: `${pr.data.title} (#${pullNumber})`,
-    commit_message: "merged autonomously by Pullfrog after a clean approval."
+    commit_title: `${pr.data.title} (#${pullNumber})`
   });
   log.info(
-    `autoMerge: pr=#${pullNumber} approvalSha=${headSha.slice(0, 7)} outstanding=0 \u2192 merged ${merge4.data.sha?.slice(0, 7)}`
+    `autoMerge: pr=#${pullNumber} @ ${headSha.slice(0, 7)} \u2192 merged directly ${merge4.data.sha?.slice(0, 7)}`
+  );
+  await comment(
+    "> \u2705 Merged autonomously after Pullfrog approved this PR and resolved all of its own review threads."
   );
-  await ctx.octokit.rest.issues.createComment({
-    owner: ctx.repo.owner,
-    repo: ctx.repo.name,
-    issue_number: pullNumber,
-    body: addFooter(
-      ctx,
-      "> \u2705 Merged autonomously after Pullfrog approved this PR and resolved all of its own review threads."
-    )
-  }).catch((err) => log.debug(`autoMerge comment failed: ${err}`));
 }
 
 // utils/reviewCleanup.ts

package/dist/internal/index.d.ts

@@ -8,7 +8,6 @@ export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export type { BuildPullfrogFooterParams, WorkflowRunFooterInfo, } from "../utils/buildPullfrogFooter.ts";
 export { buildPullfrogFooter, PULLFROG_DIVIDER, stripExistingFooter, } from "../utils/buildPullfrogFooter.ts";
-export { checkRunsGate, hasVerifiedCheck } from "../utils/checksGate.ts";
 export type { CodexAuthBody } from "../utils/codexOAuth.ts";
 export { decodeJwtExpMs, OAuthInvalidGrantError, parseCodexAuthBody, refreshCodexAuthBody, stringifyCodexAuthBody, } from "../utils/codexOAuth.ts";
 export type { ResourceUsage, UsageSummary } from "../utils/github.ts";

package/dist/internal.js

@@ -1245,26 +1245,6 @@ function stripExistingFooter(body) {
   return body.substring(0, dividerIndex).trimEnd();
 }
 
-// utils/checksGate.ts
-var OK_CONCLUSIONS = /* @__PURE__ */ new Set(["success", "neutral", "skipped"]);
-var PULLFROG_CHECKS = /* @__PURE__ */ new Set(["pullfrog", "pullfrog-approval"]);
-function checkRunsGate(params) {
-  for (const run of params.checkRuns) {
-    if (PULLFROG_CHECKS.has(run.name.toLowerCase())) continue;
-    if (run.status !== "completed")
-      return { ok: false, reason: `check "${run.name}" ${run.status}` };
-    if (!OK_CONCLUSIONS.has(run.conclusion ?? "")) {
-      return { ok: false, reason: `check "${run.name}" concluded ${run.conclusion}` };
-    }
-  }
-  return { ok: true, reason: "all checks passed" };
-}
-function hasVerifiedCheck(params) {
-  return params.checkRuns.some(
-    (r) => !PULLFROG_CHECKS.has(r.name.toLowerCase()) && r.status === "completed"
-  );
-}
-
 // utils/codexOAuth.ts
 var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
@@ -1492,7 +1472,6 @@ export {
   PULLFROG_DIVIDER,
   TIMEOUT_DISABLED,
   buildPullfrogFooter,
-  checkRunsGate,
   createLeapingProgressComment,
   decodeJwtExpMs,
   defaultAutoTier,
@@ -1503,7 +1482,6 @@ export {
   getModelProvider,
   getProgressComment,
   getProviderDisplayName,
-  hasVerifiedCheck,
   isAutoTier,
   isCardGatedModel,
   isLeapingIntoActionCommentBody,

package/dist/utils/autoMerge.d.ts

@@ -1,37 +1,28 @@
 import type { ToolContext } from "../mcp/server.ts";
 /**
- * Run-end lifecycle action: merge ANY open PR that this run mechanically
- * approved on its current head — Pullfrog acting as a full repo maintainer,
- * contributor PRs included, not just merging its own work. There is deliberately
- * NO agent-callable merge tool — the merge is a pure, deterministic consequence
- * of the runtime observing a clean approved state, so a prompt-injected agent has
- * no merge surface to reach for. Every clause is fail-closed and re-verified
- * against GitHub's own state at merge time; any failure logs why and returns
- * without merging. Best-effort — the caller wraps this in a `.catch`, and a
- * merge/comment failure can never flip the run's outcome.
+ * Run-end lifecycle action: hand any PR this run mechanically approved on its
+ * current head to GitHub's NATIVE auto-merge — Pullfrog acting as a full repo
+ * maintainer, contributor PRs included. There is deliberately NO agent-callable
+ * merge tool — the merge is a deterministic consequence of the recorded approval
+ * verdict, so a prompt-injected agent has no merge surface to reach for.
  *
- * There is NO self-authorship restriction: the approval verdict IS the trust
- * decision (Pullfrog reviewed it and would approve), exactly like a human
- * maintainer merging a contributor PR. The population of mergeable PRs is bounded
- * upstream by the review triggers (`prCreated` / `prCreatedAllowNonCollaborator`)
- * — Pullfrog can only merge what it was configured to review + approve — and the
- * whole capability is opt-in per repo (clause 1). The remaining clauses are the
- * maintainer's controls.
+ * Native auto-merge waits for all REQUIRED checks + reviews (un-fakeable by a
+ * fork), respects the human veto via branch protection, and requires branch
+ * protection to exist. We keep only the Pullfrog-specific pre-gates GitHub can't
+ * express: armed toggles, approved-THIS-head, zero outstanding Pullfrog threads,
+ * no human CHANGES_REQUESTED. Best-effort — the caller wraps this in `.catch`,
+ * and a merge/comment failure can never flip the run's outcome.
  *
  * The invariant (all must hold):
  *   1. `ctx.autoMergeEnabled` — the per-repo toggle ANDed with the global
  *      `isAutonomousMaintenanceEnabled()` kill switch, server-side (run-context).
  *   2. `ctx.prApproveEnabled` — cannot auto-merge what it may not approve.
- *   3. this run recorded an APPROVE verdict (`toolState.approval.wouldApprove`) —
- *      Pullfrog's review is the merge decision.
+ *   3. this run recorded an APPROVE verdict (`toolState.approval.wouldApprove`).
  *   4. the PR is open and not a draft.
- *   5. `toolState.approval.sha === <current head sha>` — approved THIS head, so a
- *      commit pushed after the review can't ride the approval in (409-safe below).
+ *   5. `toolState.approval.sha === <current head sha>` — approved THIS head.
  *   6. `countOutstandingPullfrogThreads === 0` — re-queried at merge time.
- *   7. no un-dismissed human CHANGES_REQUESTED — the human veto always wins.
- *   8. GitHub reports the PR mergeable and not blocked/dirty/behind.
- *   9. every external check-run/commit-status on the head is complete and
- *      non-failing (`checkRunsGate`) — red or in-flight CI never auto-merges,
- *      even on a repo without branch protection.
+ *   7. no un-dismissed human CHANGES_REQUESTED at handoff.
+ * The remaining wait-for-required-checks + wait-for-required-reviews semantics
+ * are GitHub's, via native auto-merge and branch protection.
  */
 export declare function autoMergeAfterApprove(ctx: ToolContext): Promise<void>;

package/dist/utils/proxy.d.ts

@@ -16,6 +16,7 @@
  *
  *   - 402 → `BillingError` (card declined, balance empty, 3DS, etc.)
  *   - 503 → `TransientError` (transient sync issue — retry next dispatch)
+ *   - 404 → `TransientError` (stale repo↔account link — re-homes on next webhook)
  */
 import type { ToolState } from "../toolState.ts";
 import { type OidcCredentials } from "./github.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",

package/dist/utils/checksGate.d.ts

@@ -1,45 +0,0 @@
-/**
- * Shared, dependency-free CI green/red predicate — the single source of truth for
- * "given these check-runs, is this PR head safe to merge?". Consumed by the
- * auto-merge path: `autoMerge.ts` gates the PR head at merge time, and the
- * `pr-merge-completion` webhook re-checks it before dispatching a slow-CI re-wake.
- * A red or in-flight sha never merges, and a sha with no confirmable green
- * check-run is treated as unverified (refused, not merged blind).
- *
- * Gates on the Checks API only. The Pullfrog App deliberately holds no `statuses`
- * permission (requesting it would force re-approval on every install — see
- * wiki/app-permissions.md), so the legacy Commit Statuses API is unreadable
- * (`listCommitStatusesForRef` 403s). Modern CI (GitHub Actions, etc.) reports via
- * check-runs; a repo relying on the legacy Statuses API is covered by branch
- * protection instead — a failing required status makes `mergeable_state` `blocked`,
- * which the merge invariant already refuses (`NON_MERGEABLE_STATES`).
- */
-export type CheckRun = {
-    name: string;
-    status: string;
-    conclusion: string | null;
-};
-/**
- * Refuse if any external check-run is incomplete (queued/in_progress) or concluded
- * anything other than success/neutral/skipped. Fail-closed on unknown/absent
- * conclusions. Pure so the pass/fail logic is inspectable directly.
- */
-export declare function checkRunsGate(params: {
-    checkRuns: CheckRun[];
-}): {
-    ok: boolean;
-    reason: string;
-};
-/**
- * true when the head has ≥1 CONCLUDED non-failing EXTERNAL check-run — CI
- * positively ran, not merely "no red was seen". paired with `checkRunsGate.ok`
- * (any completed check is non-failing), this == "≥1 concluded non-failing check".
- * the merge requires it: a head with ZERO check-runs passes
- * `checkRunsGate` (nothing red) but has no verification, and since the app can't
- * read legacy commit statuses, "zero check-runs" is indistinguishable from "green
- * Actions but a red CircleCI status" — so we only act on a head we can positively
- * confirm is green. Pullfrog's own verdict checks don't count as external CI.
- */
-export declare function hasVerifiedCheck(params: {
-    checkRuns: CheckRun[];
-}): boolean;