pullfrog 0.1.39 → 0.1.40

package/dist/cli.mjs

@@ -102494,7 +102494,7 @@ async function preflightClaudeSubscription(params) {
   } catch {
     return { usable: true };
   }
-  if (res.status !== 401 && res.status !== 429) return { usable: true };
+  if (res.status !== 401 && res.status !== 403 && res.status !== 429) return { usable: true };
   const body = await res.text().catch(() => "");
   return { usable: false, reason: `${res.status}: ${extractApiErrorMessage(body)}` };
 }
@@ -102997,7 +102997,7 @@ function extractExcerpt(text, matchIndex) {
   }
   return excerpt.trim();
 }
-var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford/is;
+var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford|Key limit exceeded \(total limit\)/is;
 function isRouterKeylimitExhaustedError(text) {
   return ROUTER_KEYLIMIT_EXHAUSTED_PATTERN.test(text);
 }
@@ -103022,7 +103022,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.39",
+  version: "0.1.40",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -110466,7 +110466,6 @@ function newTurn() {
     finalText: "",
     tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
-    sessionError: null,
     lastToolError: null
   };
 }
@@ -110497,7 +110496,6 @@ async function dispatchEvent(ctx, event) {
     if (sessionID !== ctx.orchestratorSessionID) return;
     const err = event.properties.error;
     const message = err ? extractErrorMessage(err) : "(no error payload)";
-    if (ctx.currentTurn) ctx.currentTurn.sessionError = message;
     log.info(`\xBB ${ctx.label} session error: ${message}`);
     return;
   }
@@ -110690,14 +110688,6 @@ async function runPromptTurn(ctx, params) {
       usage
     };
   }
-  if (turn.sessionError) {
-    return {
-      success: false,
-      output: finalText,
-      error: `session error: ${turn.sessionError}`,
-      usage
-    };
-  }
   return { success: true, output: finalText, usage };
 }
 async function aggregateTurnUsage(ctx, turnStartMs) {
@@ -164715,10 +164705,13 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isClaudeSubscriptionDisabledError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
-  return /authentication token has expired/i.test(text) || /Token refresh failed/i.test(text);
+  return /authentication token has (expired|been invalidated)/i.test(text) || /OAuth access token has expired/i.test(text) || /Token refresh failed/i.test(text);
+}
+function isClaudeSubscriptionDisabledError(text) {
+  return /disabled Claude subscription access/i.test(text);
 }
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
@@ -164727,11 +164720,18 @@ function formatApiKeyErrorSummary(params) {
   }
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  if (isClaudeSubscriptionDisabledError(params.raw)) {
+    return [
+      `**Your organization has disabled Claude subscription access for Claude Code.** Ask your Claude organization's admin to re-enable it in the Claude Console, or set an \`ANTHROPIC_API_KEY\` for this repo instead, then re-trigger the run.`,
+      "",
+      `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
-      `**Your provider OAuth credential has expired.** Re-authenticate the provider connection (e.g. \`pullfrog auth codex\`), then re-trigger the run.`,
+      `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\`), then re-trigger the run.`,
       "",
-      `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+      `[Claude subscription \u2192](https://docs.pullfrog.com/claude-auth) \xB7 [ChatGPT subscription \u2192](https://docs.pullfrog.com/codex-auth) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
   return [
@@ -168517,7 +168517,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.39";
+var VERSION10 = "0.1.40";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -100565,7 +100565,7 @@ async function preflightClaudeSubscription(params) {
   } catch {
     return { usable: true };
   }
-  if (res.status !== 401 && res.status !== 429) return { usable: true };
+  if (res.status !== 401 && res.status !== 403 && res.status !== 429) return { usable: true };
   const body = await res.text().catch(() => "");
   return { usable: false, reason: `${res.status}: ${extractApiErrorMessage(body)}` };
 }
@@ -101068,7 +101068,7 @@ function extractExcerpt(text, matchIndex) {
   }
   return excerpt.trim();
 }
-var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford/is;
+var ROUTER_KEYLIMIT_EXHAUSTED_PATTERN = /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford|Key limit exceeded \(total limit\)/is;
 function isRouterKeylimitExhaustedError(text) {
   return ROUTER_KEYLIMIT_EXHAUSTED_PATTERN.test(text);
 }
@@ -101093,7 +101093,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.39",
+  version: "0.1.40",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -108579,7 +108579,6 @@ function newTurn() {
     finalText: "",
     tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
-    sessionError: null,
     lastToolError: null
   };
 }
@@ -108610,7 +108609,6 @@ async function dispatchEvent(ctx, event) {
     if (sessionID !== ctx.orchestratorSessionID) return;
     const err = event.properties.error;
     const message = err ? extractErrorMessage(err) : "(no error payload)";
-    if (ctx.currentTurn) ctx.currentTurn.sessionError = message;
     log.info(`\xBB ${ctx.label} session error: ${message}`);
     return;
   }
@@ -108803,14 +108801,6 @@ async function runPromptTurn(ctx, params) {
       usage
     };
   }
-  if (turn.sessionError) {
-    return {
-      success: false,
-      output: finalText,
-      error: `session error: ${turn.sessionError}`,
-      usage
-    };
-  }
   return { success: true, output: finalText, usage };
 }
 async function aggregateTurnUsage(ctx, turnStartMs) {
@@ -162828,10 +162818,13 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isClaudeSubscriptionDisabledError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
-  return /authentication token has expired/i.test(text) || /Token refresh failed/i.test(text);
+  return /authentication token has (expired|been invalidated)/i.test(text) || /OAuth access token has expired/i.test(text) || /Token refresh failed/i.test(text);
+}
+function isClaudeSubscriptionDisabledError(text) {
+  return /disabled Claude subscription access/i.test(text);
 }
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
@@ -162840,11 +162833,18 @@ function formatApiKeyErrorSummary(params) {
   }
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  if (isClaudeSubscriptionDisabledError(params.raw)) {
+    return [
+      `**Your organization has disabled Claude subscription access for Claude Code.** Ask your Claude organization's admin to re-enable it in the Claude Console, or set an \`ANTHROPIC_API_KEY\` for this repo instead, then re-trigger the run.`,
+      "",
+      `[Add repo secret \u2192](${githubSecretsUrl}) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+    ].join("\n");
+  }
   if (isOAuthCredentialExpiredError(params.raw)) {
     return [
-      `**Your provider OAuth credential has expired.** Re-authenticate the provider connection (e.g. \`pullfrog auth codex\`), then re-trigger the run.`,
+      `**Your provider OAuth credential has expired or been revoked.** Re-authenticate the provider connection (e.g. \`pullfrog auth claude\` / \`pullfrog auth codex\`), then re-trigger the run.`,
       "",
-      `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+      `[Claude subscription \u2192](https://docs.pullfrog.com/claude-auth) \xB7 [ChatGPT subscription \u2192](https://docs.pullfrog.com/codex-auth) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
   return [

package/dist/utils/apiKeys.d.ts

@@ -37,6 +37,9 @@ export declare function validateAgentApiKey(params: {
  *     ****XXXX is invalid`. anchored to "Your api key: ... is invalid" so it
  *     can't collide with DeepSeek's already-handled `Insufficient balance`
  *     billing shape (which routes to formatProviderBillingExhausted).
+ *   - org-disabled Claude subscription (#1072): `Your organization has
+ *     disabled Claude subscription access for Claude Code`, an entitlement
+ *     denial with its own remedy — see isClaudeSubscriptionDisabledError.
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**
@@ -46,8 +49,17 @@ export declare function isApiKeyAuthError(text: string): boolean;
  * distinct copy for these. Patterns are deliberately narrow:
  * "authentication token has expired" (not bare "token has expired") so a
  * GitHub installation-token expiry can't be misread as an LLM key problem.
+ * also covers server-side revocation ("authentication token has been
+ * invalidated", OpenAI `token_invalidated`, #1041) and the Claude CLI's
+ * "OAuth access token has expired" phrasing (#1072) — same remediation.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
+/**
+ * Anthropic entitlement denial for Claude Pro/Max subscription auth (#1072):
+ * an org admin turned off Claude Code subscription access. no credential the
+ * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
+ */
+export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/claudeSubscription.d.ts

@@ -16,7 +16,9 @@ export type SubscriptionPreflight = {
  * per-model ("You've hit your Opus limit"), so a cheaper stand-in could pass
  * preflight and still leave the run dead on arrival.
  *
- * fail-open by design: only 401 (revoked/expired token) and 429
+ * fail-open by design: only 401 (revoked/expired token), 403 (Anthropic
+ * `permission_error` — the credential isn't entitled to serve this run, e.g.
+ * an org disabled Claude Code subscription access, #1072) and 429
  * (session/weekly/per-model limit) mark the token unusable. network errors,
  * 5xx, and request-shape drift (400) all keep today's subscription-first
  * behavior, so the preflight can never fail a run that would have worked —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",