pullfrog 0.1.45 → 0.1.46

package/dist/agents/opencodeShared.d.ts

@@ -16,6 +16,30 @@ export type OpenCodeConfig = {
 export declare function geminiHighThinkingOverrides(): Record<string, {
     options: object;
 }>;
+interface OpenAICompatibleProviderEntry {
+    npm: string;
+    name: string;
+    options: {
+        baseURL: string | undefined;
+        apiKey: string | undefined;
+    };
+    models: Record<string, {
+        name: string;
+        limit: ModelLimit;
+    }>;
+}
+interface ModelLimit {
+    context: number;
+    output: number;
+}
+/**
+ * OpenAI-compatible provider block for OPENCODE_CONFIG_CONTENT. opencode has no
+ * native provider for an arbitrary gateway, so inject one via
+ * `@ai-sdk/openai-compatible` when the run targets `openai-compatible/<model>`;
+ * `{}` otherwise so the caller can spread it unconditionally. base URL + key are
+ * guaranteed present by `validateOpenAICompatibleSetup`.
+ */
+export declare function openAICompatibleProvider(model: string | undefined): Record<string, OpenAICompatibleProviderEntry>;
 /**
  * Build the `provider.openrouter.models[id].options` map that pins every Kimi
  * K2 OpenRouter alias away from the Enforcer-less providers via OpenRouter's
@@ -75,3 +99,4 @@ export declare function installOpencodeCli(params: {
     binPath: string;
 }): Promise<string>;
 export declare function autoSelectModel(): string | undefined;
+export {};

package/dist/cli.mjs

@@ -102119,6 +102119,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],
@@ -102336,6 +102358,12 @@ var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+var OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+var OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+var OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 function isBedrockAnthropicId(bedrockModelId) {
   return bedrockModelId.toLowerCase().split(/[./:]/).includes("anthropic");
 }
@@ -103022,7 +103050,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.45",
+  version: "0.1.46",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -110769,8 +110797,9 @@ function readModels(cliPath) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
-    failure = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim() || void 0;
-    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure ?? result.error}`);
+    const stderr = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim();
+    failure = stderr || result.error?.message;
+    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure}`);
     return /* @__PURE__ */ new Set();
   }
   failure = void 0;
@@ -110828,6 +110857,29 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+function openAICompatibleLimit() {
+  return {
+    context: Number(process.env[OPENAI_COMPATIBLE_CONTEXT_ENV]),
+    output: Number(process.env[OPENAI_COMPATIBLE_MAX_OUTPUT_ENV])
+  };
+}
+function openAICompatibleProvider(model) {
+  const prefix = `${OPENAI_COMPATIBLE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const modelId = model.slice(prefix.length);
+  return {
+    [OPENAI_COMPATIBLE_PROVIDER]: {
+      npm: "@ai-sdk/openai-compatible",
+      name: "OpenAI-compatible",
+      options: {
+        // trailing slash would double up against opencode's `/chat/completions` join
+        baseURL: process.env[OPENAI_COMPATIBLE_BASE_URL_ENV]?.replace(/\/$/, ""),
+        apiKey: process.env[OPENAI_COMPATIBLE_API_KEY_ENV]
+      },
+      models: { [modelId]: { name: modelId, limit: openAICompatibleLimit() } }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -110919,7 +110971,8 @@ function buildSecurityConfig(ctx, model) {
       google: { models: geminiHighThinkingOverrides() },
       openrouter: {
         models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
-      }
+      },
+      ...openAICompatibleProvider(model)
     }
   };
   if (model) {
@@ -165185,6 +165238,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "openai-compatible") {
+    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
+    if (!modelId) {
+      throw new Error(
+        `${OPENAI_COMPATIBLE_MODEL_ENV} env var is required when the model is set to "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
+      );
+    }
+    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
+  }
   return resolveCliModel(slug2);
 }
 function resolveModel(ctx) {
@@ -165234,6 +165296,21 @@ function resolveAgent(ctx) {
 
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
+var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
+function buildKeyError(params) {
+  return params.secretsUnavailable ? buildSecretsUnavailableError(params) : buildMissingApiKeyError(params);
+}
+function buildSecretsUnavailableError(params) {
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  const modelClause = params.model ? ` needed for \`${params.model}\`` : "";
+  return [
+    `**Pullfrog ${SECRETS_UNAVAILABLE_MARKER}${modelClause} on this run.** The key is still stored \u2014 the runner just couldn't fetch it, so this is a transient failure on our side, not a missing key.`,
+    "",
+    "**To fix:** re-run the job. If it keeps happening, tell us in Discord.",
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+  ].join("\n");
+}
 function buildMissingApiKeyError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
@@ -165276,10 +165353,47 @@ add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then
 
 for full setup instructions, see https://docs.pullfrog.com/vertex`;
 }
+function buildOpenAICompatibleSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `OpenAI-compatible model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. everything else is plain workflow \`env:\`:
+
+  ${OPENAI_COMPATIBLE_BASE_URL_ENV}: https://your-endpoint.example.com/v1
+  ${OPENAI_COMPATIBLE_API_KEY_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_API_KEY_ENV} }}
+  ${OPENAI_COMPATIBLE_MODEL_ENV}: <model-id>
+  ${OPENAI_COMPATIBLE_CONTEXT_ENV}: "128000"
+  ${OPENAI_COMPATIBLE_MAX_OUTPUT_ENV}: "16384"
+
+set the last two to the real limits of the model your endpoint serves. Pullfrog can't
+discover them \u2014 your endpoint owns the model catalog \u2014 and without them completions are
+capped at 32000 tokens (rejected outright by models with a smaller cap) and
+auto-compaction is disabled, so long runs grow until your endpoint refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function hasPositiveNumberEnvVar(name) {
+  return Number(process.env[name]) > 0;
+}
+function validateOpenAICompatibleSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_CONTEXT_ENV))
+    missing.push(OPENAI_COMPATIBLE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV))
+    missing.push(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(
+      buildOpenAICompatibleSetupError({ owner: params.owner, name: params.name, missing })
+    );
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -165314,6 +165428,10 @@ function validateAgentApiKey(params) {
       validateVertexSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`)) {
+      validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -165326,23 +165444,46 @@ function validateAgentApiKey(params) {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
+      if (getModelEnvVars(params.model).some(hasEnvVar3)) return;
       throw new Error(
-        buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+        buildKeyError({
+          owner: params.owner,
+          name: params.name,
+          model: params.model,
+          secretsUnavailable: params.secretsUnavailable
+        })
       );
     }
     if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
     throw new Error(
-      buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        model: params.model,
+        secretsUnavailable: params.secretsUnavailable
+      })
     );
   }
   if (params.agent.name === "opencode") {
     if (params.authorized.size > 0) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
-    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+    throw new Error(
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        secretsUnavailable: params.secretsUnavailable
+      })
+    );
   }
   if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
-  throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  throw new Error(
+    buildKeyError({
+      owner: params.owner,
+      name: params.name,
+      secretsUnavailable: params.secretsUnavailable
+    })
+  );
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
@@ -166027,7 +166168,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/"));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -166836,6 +166977,10 @@ var defaultRunContext = {
   oss: false,
   plan: "none"
 };
+var unknownSecretsRunContext = {
+  ...defaultRunContext,
+  secretsUnavailable: true
+};
 async function fetchRunContext(params) {
   const timeoutMs = 3e4;
   const controller = new AbortController();
@@ -166854,7 +166999,7 @@ async function fetchRunContext(params) {
     });
     clearTimeout(timeoutId);
     if (!response.ok) {
-      return defaultRunContext;
+      return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
     }
     const data = await response.json();
     if (data === null) {
@@ -166878,11 +167023,12 @@ async function fetchRunContext(params) {
       oss: data.oss ?? false,
       plan: data.plan ?? "none",
       proxyModel: data.proxyModel,
-      dbSecrets: data.dbSecrets
+      dbSecrets: data.dbSecrets,
+      secretsUnavailable: data.secretsUnavailable
     };
   } catch {
     clearTimeout(timeoutId);
-    return defaultRunContext;
+    return unknownSecretsRunContext;
   }
 }
 
@@ -166904,7 +167050,10 @@ async function resolveRunContextData(params) {
   const repoContext = parseRepoContext();
   let oidcToken;
   try {
-    oidcToken = await core9.getIDToken("pullfrog-api");
+    oidcToken = await op(() => core9.getIDToken("pullfrog-api"), {
+      name: "OIDC mint",
+      retries: process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? [200, 1e3] : []
+    })();
   } catch {
   }
   const [repoResponse, runContext] = await Promise.all([
@@ -166926,7 +167075,10 @@ async function resolveRunContextData(params) {
     oss: runContext.oss,
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
-    dbSecrets: runContext.dbSecrets
+    dbSecrets: runContext.dbSecrets,
+    // a failed mint on a runner that should have been able to mint is the same
+    // outcome as the server-side failure: the run never sees stored secrets.
+    secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0
   };
 }
 
@@ -167091,6 +167243,9 @@ function renderRunError(input) {
   if (input.errorMessage.includes(MODEL_ACCESS_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
+  if (input.errorMessage.includes(SECRETS_UNAVAILABLE_MARKER)) {
+    return { summary: input.errorMessage, comment: input.errorMessage };
+  }
   const isHang = input.errorMessage.startsWith("activity timeout") || input.errorMessage.startsWith("agent still pending");
   const hangBody = isHang ? formatAgentHangBody({
     diagnostic: input.agentDiagnostic,
@@ -167825,7 +167980,8 @@ async function main() {
             model: effectiveModel,
             authorized: getAuthorizedModels(),
             owner: runContext.repo.owner,
-            name: runContext.repo.name
+            name: runContext.repo.name,
+            secretsUnavailable: runContext.secretsUnavailable
           });
         }
         await setupGit({
@@ -168322,7 +168478,7 @@ function link(text, url4) {
   return `\x1B]8;;${url4}\x07${text}\x1B]8;;\x07`;
 }
 function buildProviders() {
-  return Object.entries(providers).filter(([key]) => key !== "opencode" && key !== "openrouter" && key !== "bedrock").map(([key, config3]) => {
+  return Object.entries(providers).filter(([key]) => key !== "opencode" && key !== "openrouter").map(([key, config3]) => {
     const aliases = modelAliases.filter(
       (a) => a.provider === key && !a.fallback && !a.routing && !a.hidden
     );
@@ -168342,7 +168498,7 @@ function buildProviders() {
         hint: a === recommended ? "recommended" : void 0
       }))
     };
-  });
+  }).filter((p2) => p2.models.length > 0);
 }
 var CLI_PROVIDERS = buildProviders();
 function resolveModelProvider(slug2) {
@@ -169152,7 +169308,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.45";
+var VERSION10 = "0.1.46";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -100190,6 +100190,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],
@@ -100407,6 +100429,12 @@ var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+var OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+var OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+var OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 function isBedrockAnthropicId(bedrockModelId) {
   return bedrockModelId.toLowerCase().split(/[./:]/).includes("anthropic");
 }
@@ -101093,7 +101121,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.45",
+  version: "0.1.46",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -108882,8 +108910,9 @@ function readModels(cliPath) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
-    failure = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim() || void 0;
-    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure ?? result.error}`);
+    const stderr = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim();
+    failure = stderr || result.error?.message;
+    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure}`);
     return /* @__PURE__ */ new Set();
   }
   failure = void 0;
@@ -108941,6 +108970,29 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+function openAICompatibleLimit() {
+  return {
+    context: Number(process.env[OPENAI_COMPATIBLE_CONTEXT_ENV]),
+    output: Number(process.env[OPENAI_COMPATIBLE_MAX_OUTPUT_ENV])
+  };
+}
+function openAICompatibleProvider(model) {
+  const prefix = `${OPENAI_COMPATIBLE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const modelId = model.slice(prefix.length);
+  return {
+    [OPENAI_COMPATIBLE_PROVIDER]: {
+      npm: "@ai-sdk/openai-compatible",
+      name: "OpenAI-compatible",
+      options: {
+        // trailing slash would double up against opencode's `/chat/completions` join
+        baseURL: process.env[OPENAI_COMPATIBLE_BASE_URL_ENV]?.replace(/\/$/, ""),
+        apiKey: process.env[OPENAI_COMPATIBLE_API_KEY_ENV]
+      },
+      models: { [modelId]: { name: modelId, limit: openAICompatibleLimit() } }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -109032,7 +109084,8 @@ function buildSecurityConfig(ctx, model) {
       google: { models: geminiHighThinkingOverrides() },
       openrouter: {
         models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
-      }
+      },
+      ...openAICompatibleProvider(model)
     }
   };
   if (model) {
@@ -163298,6 +163351,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "openai-compatible") {
+    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
+    if (!modelId) {
+      throw new Error(
+        `${OPENAI_COMPATIBLE_MODEL_ENV} env var is required when the model is set to "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
+      );
+    }
+    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
+  }
   return resolveCliModel(slug2);
 }
 function resolveModel(ctx) {
@@ -163347,6 +163409,21 @@ function resolveAgent(ctx) {
 
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
+var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
+function buildKeyError(params) {
+  return params.secretsUnavailable ? buildSecretsUnavailableError(params) : buildMissingApiKeyError(params);
+}
+function buildSecretsUnavailableError(params) {
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  const modelClause = params.model ? ` needed for \`${params.model}\`` : "";
+  return [
+    `**Pullfrog ${SECRETS_UNAVAILABLE_MARKER}${modelClause} on this run.** The key is still stored \u2014 the runner just couldn't fetch it, so this is a transient failure on our side, not a missing key.`,
+    "",
+    "**To fix:** re-run the job. If it keeps happening, tell us in Discord.",
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+  ].join("\n");
+}
 function buildMissingApiKeyError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
@@ -163389,10 +163466,47 @@ add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then
 
 for full setup instructions, see https://docs.pullfrog.com/vertex`;
 }
+function buildOpenAICompatibleSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `OpenAI-compatible model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. everything else is plain workflow \`env:\`:
+
+  ${OPENAI_COMPATIBLE_BASE_URL_ENV}: https://your-endpoint.example.com/v1
+  ${OPENAI_COMPATIBLE_API_KEY_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_API_KEY_ENV} }}
+  ${OPENAI_COMPATIBLE_MODEL_ENV}: <model-id>
+  ${OPENAI_COMPATIBLE_CONTEXT_ENV}: "128000"
+  ${OPENAI_COMPATIBLE_MAX_OUTPUT_ENV}: "16384"
+
+set the last two to the real limits of the model your endpoint serves. Pullfrog can't
+discover them \u2014 your endpoint owns the model catalog \u2014 and without them completions are
+capped at 32000 tokens (rejected outright by models with a smaller cap) and
+auto-compaction is disabled, so long runs grow until your endpoint refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function hasPositiveNumberEnvVar(name) {
+  return Number(process.env[name]) > 0;
+}
+function validateOpenAICompatibleSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_CONTEXT_ENV))
+    missing.push(OPENAI_COMPATIBLE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV))
+    missing.push(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(
+      buildOpenAICompatibleSetupError({ owner: params.owner, name: params.name, missing })
+    );
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -163427,6 +163541,10 @@ function validateAgentApiKey(params) {
       validateVertexSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`)) {
+      validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -163439,23 +163557,46 @@ function validateAgentApiKey(params) {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
+      if (getModelEnvVars(params.model).some(hasEnvVar3)) return;
       throw new Error(
-        buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+        buildKeyError({
+          owner: params.owner,
+          name: params.name,
+          model: params.model,
+          secretsUnavailable: params.secretsUnavailable
+        })
       );
     }
     if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
     throw new Error(
-      buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        model: params.model,
+        secretsUnavailable: params.secretsUnavailable
+      })
     );
   }
   if (params.agent.name === "opencode") {
     if (params.authorized.size > 0) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
-    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+    throw new Error(
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        secretsUnavailable: params.secretsUnavailable
+      })
+    );
   }
   if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
-  throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  throw new Error(
+    buildKeyError({
+      owner: params.owner,
+      name: params.name,
+      secretsUnavailable: params.secretsUnavailable
+    })
+  );
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
@@ -164140,7 +164281,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/"));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -164949,6 +165090,10 @@ var defaultRunContext = {
   oss: false,
   plan: "none"
 };
+var unknownSecretsRunContext = {
+  ...defaultRunContext,
+  secretsUnavailable: true
+};
 async function fetchRunContext(params) {
   const timeoutMs = 3e4;
   const controller = new AbortController();
@@ -164967,7 +165112,7 @@ async function fetchRunContext(params) {
     });
     clearTimeout(timeoutId);
     if (!response.ok) {
-      return defaultRunContext;
+      return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
     }
     const data = await response.json();
     if (data === null) {
@@ -164991,11 +165136,12 @@ async function fetchRunContext(params) {
       oss: data.oss ?? false,
       plan: data.plan ?? "none",
       proxyModel: data.proxyModel,
-      dbSecrets: data.dbSecrets
+      dbSecrets: data.dbSecrets,
+      secretsUnavailable: data.secretsUnavailable
     };
   } catch {
     clearTimeout(timeoutId);
-    return defaultRunContext;
+    return unknownSecretsRunContext;
   }
 }
 
@@ -165017,7 +165163,10 @@ async function resolveRunContextData(params) {
   const repoContext = parseRepoContext();
   let oidcToken;
   try {
-    oidcToken = await core9.getIDToken("pullfrog-api");
+    oidcToken = await op(() => core9.getIDToken("pullfrog-api"), {
+      name: "OIDC mint",
+      retries: process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? [200, 1e3] : []
+    })();
   } catch {
   }
   const [repoResponse, runContext] = await Promise.all([
@@ -165039,7 +165188,10 @@ async function resolveRunContextData(params) {
     oss: runContext.oss,
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
-    dbSecrets: runContext.dbSecrets
+    dbSecrets: runContext.dbSecrets,
+    // a failed mint on a runner that should have been able to mint is the same
+    // outcome as the server-side failure: the run never sees stored secrets.
+    secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0
   };
 }
 
@@ -165204,6 +165356,9 @@ function renderRunError(input) {
   if (input.errorMessage.includes(MODEL_ACCESS_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
+  if (input.errorMessage.includes(SECRETS_UNAVAILABLE_MARKER)) {
+    return { summary: input.errorMessage, comment: input.errorMessage };
+  }
   const isHang = input.errorMessage.startsWith("activity timeout") || input.errorMessage.startsWith("agent still pending");
   const hangBody = isHang ? formatAgentHangBody({
     diagnostic: input.agentDiagnostic,
@@ -165938,7 +166093,8 @@ async function main() {
             model: effectiveModel,
             authorized: getAuthorizedModels(),
             owner: runContext.repo.owner,
-            name: runContext.repo.name
+            name: runContext.repo.name,
+            secretsUnavailable: runContext.secretsUnavailable
           });
         }
         await setupGit({

package/dist/internal.js

@@ -381,6 +381,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],

package/dist/models.d.ts

@@ -20,7 +20,7 @@
  * env var and routes to claude-code for Anthropic IDs or opencode for
  * everything else.
  */
-export type ModelRouting = "bedrock" | "vertex";
+export type ModelRouting = "bedrock" | "vertex" | "openai-compatible";
 export interface ModelAlias {
     /** stable alias stored in DB, e.g. "anthropic/claude-opus" */
     slug: string;
@@ -99,6 +99,7 @@ export declare const providers: {
     "opencode-go": ProviderConfig;
     bedrock: ProviderConfig;
     vertex: ProviderConfig;
+    "openai-compatible": ProviderConfig;
     openrouter: ProviderConfig;
 };
 export type ModelProvider = keyof typeof providers;
@@ -196,6 +197,31 @@ export declare function getAutoSelectHintModel(): string;
 export declare const BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 /** env var that supplies the Vertex AI model ID for the `vertex/byok` slug. */
 export declare const VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+/** provider key + slug prefix for the generic OpenAI-compatible BYOK backend. */
+export declare const OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+/** base URL of the user's OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway URL). */
+export declare const OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+/** API key/token for the user's OpenAI-compatible endpoint — the one sensitive secret. */
+export declare const OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+/** model ID served by the endpoint, supplied for the `openai-compatible/byok` slug. */
+export declare const OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+/**
+ * context-window size of the endpoint's model. required — `validateOpenAICompatibleSetup`
+ * rejects the run pre-agent when it's unset or non-numeric. it also gates
+ * auto-compaction: opencode's `isOverflow` short-circuits when
+ * `limit.context === 0`, which would otherwise let a long session grow until the
+ * endpoint rejects it on context length.
+ */
+export declare const OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+/**
+ * max completion tokens the endpoint's model accepts. required — see
+ * OPENAI_COMPATIBLE_CONTEXT_ENV. opencode has no models.dev metadata for a
+ * user-supplied endpoint, and an undeclared limit makes it send
+ * `max_tokens: 32000`, which most models reject outright (gpt-4o and gpt-4o-mini
+ * cap at 16384, many open models at 4096/8192). opencode's `limit` requires
+ * `context` + `output` together, so the pair is validated and emitted as a unit.
+ */
+export declare const OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 /**
  * the Bedrock model ID passed to claude-code or opencode is whatever the
  * user set in `BEDROCK_MODEL_ID` — Pullfrog never resolves or upgrades it.

package/dist/utils/apiKeys.d.ts

@@ -1,3 +1,10 @@
+/**
+ * marker for the distinct "run-context couldn't hand over your stored secrets"
+ * body. surfaced verbatim by `runErrorRenderer` (same contract as
+ * `MODEL_ACCESS_MARKER`) because blaming the user for a transient fetch failure
+ * on our side is the wrong CTA — their key is configured and still stored.
+ */
+export declare const SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
 /**
  * Validate that the resolved model can actually be served by the chosen
  * agent. For routing slugs (Bedrock / Vertex) the auth shape is multi-var
@@ -16,6 +23,9 @@ export declare function validateAgentApiKey(params: {
     authorized: Set<string>;
     owner: string;
     name: string;
+    /** run-context couldn't hand over Pullfrog-stored secrets, so a missing key
+     * says nothing about what the user actually configured. */
+    secretsUnavailable?: boolean | undefined;
 }): void;
 /**
  * Detect agent-runtime auth failures that should be reformatted as an actionable

package/dist/utils/runContext.d.ts

@@ -55,6 +55,13 @@ export interface RunContext {
     plan: AccountPlan;
     proxyModel?: string | undefined;
     dbSecrets?: Record<string, string> | undefined;
+    /**
+     * the server tried and failed to materialize Pullfrog-stored secrets (or we
+     * never got a usable response at all). distinct from an absent `dbSecrets`,
+     * which legitimately means the user has none stored — without the
+     * distinction a transient failure renders as "you have no API key".
+     */
+    secretsUnavailable?: boolean | undefined;
 }
 /**
  * fetch run context from Pullfrog API

package/dist/utils/runContextData.d.ts

@@ -13,6 +13,9 @@ export interface RunContextData {
     plan: AccountPlan;
     proxyModel?: string | undefined;
     dbSecrets?: Record<string, string> | undefined;
+    /** stored secrets couldn't be materialized for this run — not the same as
+     * the user having none. see `RunContext.secretsUnavailable`. */
+    secretsUnavailable?: boolean | undefined;
 }
 interface ResolveRunContextDataParams {
     octokit: OctokitWithPlugins;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",