pullfrog 0.1.39 → 0.1.41

package/dist/utils/apiKeys.d.ts

@@ -37,6 +37,9 @@ export declare function validateAgentApiKey(params: {
  *     ****XXXX is invalid`. anchored to "Your api key: ... is invalid" so it
  *     can't collide with DeepSeek's already-handled `Insufficient balance`
  *     billing shape (which routes to formatProviderBillingExhausted).
+ *   - org-disabled Claude subscription (#1072): `Your organization has
+ *     disabled Claude subscription access for Claude Code`, an entitlement
+ *     denial with its own remedy — see isClaudeSubscriptionDisabledError.
  */
 export declare function isApiKeyAuthError(text: string): boolean;
 /**
@@ -46,8 +49,17 @@ export declare function isApiKeyAuthError(text: string): boolean;
  * distinct copy for these. Patterns are deliberately narrow:
  * "authentication token has expired" (not bare "token has expired") so a
  * GitHub installation-token expiry can't be misread as an LLM key problem.
+ * also covers server-side revocation ("authentication token has been
+ * invalidated", OpenAI `token_invalidated`, #1041) and the Claude CLI's
+ * "OAuth access token has expired" phrasing (#1072) — same remediation.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
+/**
+ * Anthropic entitlement denial for Claude Pro/Max subscription auth (#1072):
+ * an org admin turned off Claude Code subscription access. no credential the
+ * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
+ */
+export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/claudeSubscription.d.ts

@@ -16,7 +16,9 @@ export type SubscriptionPreflight = {
  * per-model ("You've hit your Opus limit"), so a cheaper stand-in could pass
  * preflight and still leave the run dead on arrival.
  *
- * fail-open by design: only 401 (revoked/expired token) and 429
+ * fail-open by design: only 401 (revoked/expired token), 403 (Anthropic
+ * `permission_error` — the credential isn't entitled to serve this run, e.g.
+ * an org disabled Claude Code subscription access, #1072) and 429
  * (session/weekly/per-model limit) mark the token unusable. network errors,
  * 5xx, and request-shape drift (400) all keep today's subscription-first
  * behavior, so the preflight can never fail a run that would have worked —

package/dist/utils/openCodeModels.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Why the last `opencode models` came back empty, in opencode's own words.
+ *
+ * An unloadable repo config (`opencode.json`, `.opencode/**`) is the common cause
+ * and is fatal — opencode's schema is strict, so every later invocation fails the
+ * same way. Without this the empty set reaches `validateAgentApiKey` and the run
+ * dies telling the user to go add provider secrets, which is a false lead.
+ */
+export declare function getModelsFailure(): string | undefined;
 /** Snapshot the set of models OpenCode can serve from the current env, BEFORE
  * Pullfrog-stored credentials are merged in. Call once early in `main.ts`. */
 export declare function captureBaselineModels(cliPath: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",
@@ -31,7 +31,7 @@
     "@ark/util": "0.56.0",
     "@clack/prompts": "^1.2.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@opencode-ai/sdk": "1.16.2",
+    "@opencode-ai/sdk": "1.18.5",
     "@octokit/plugin-throttling": "^11.0.3",
     "@octokit/rest": "^22.0.0",
     "@octokit/webhooks-types": "^7.6.1",
@@ -54,7 +54,7 @@
     "husky": "^9.0.0",
     "lru-cache": "^11.0.0",
     "object-hash": "^3.0.0",
-    "opencode-ai": "1.16.2",
+    "opencode-ai": "1.18.5",
     "package-manager-detector": "^1.6.0",
     "picocolors": "^1.1.1",
     "semver": "^7.7.3",