pullfrog 0.1.45 → 0.1.47

package/dist/cli.mjs

@@ -101356,6 +101356,10 @@ async function setPullfrogSecret(ctx) {
   }
   return { saved: false, error: result.data.error || `api returned ${result.status}` };
 }
+function describeSecretTarget(ctx) {
+  if (ctx.scope === "account") return `account ${import_picocolors.default.cyan(`@${ctx.owner}`)}`;
+  return `repo ${import_picocolors.default.cyan(`${ctx.owner}/${ctx.repo}`)}`;
+}
 async function promptScope(ctx) {
   const scope2 = await _t({
     message: "secret scope",
@@ -101579,7 +101583,8 @@ async function runCodexAuth() {
       O2.warn(err instanceof Error ? err.message : String(err));
       savable = auth2;
     }
-    spin.start(`saving ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to Pullfrog`);
+    const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
+    spin.start(`saving ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
     const result = await setPullfrogSecret({
       token,
       owner: remote.owner,
@@ -101596,7 +101601,7 @@ async function runCodexAuth() {
       );
       process.exit(1);
     }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to Pullfrog (${scope2})`);
+    spin.stop(`saved ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
     setActiveSpin(null);
     gt("done.");
   } catch (error49) {
@@ -101693,7 +101698,8 @@ async function runClaudeAuth() {
         `that doesn't look like a ${import_picocolors2.default.cyan("claude setup-token")} token (expected ${import_picocolors2.default.cyan(`${CLAUDE_OAUTH_TOKEN_PREFIX}\u2026`)}). saving it anyway.`
       );
     }
-    spin.start(`saving ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to Pullfrog`);
+    const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
+    spin.start(`saving ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
     const result = await setPullfrogSecret({
       token,
       owner: remote.owner,
@@ -101710,7 +101716,7 @@ async function runClaudeAuth() {
       );
       process.exit(1);
     }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to Pullfrog (${scope2})`);
+    spin.stop(`saved ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
     setActiveSpin(null);
     gt("done.");
   } catch (error49) {
@@ -102119,6 +102125,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],
@@ -102336,6 +102364,12 @@ var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+var OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+var OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+var OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 function isBedrockAnthropicId(bedrockModelId) {
   return bedrockModelId.toLowerCase().split(/[./:]/).includes("anthropic");
 }
@@ -103022,7 +103056,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.45",
+  version: "0.1.47",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -110769,8 +110803,9 @@ function readModels(cliPath) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
-    failure = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim() || void 0;
-    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure ?? result.error}`);
+    const stderr = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim();
+    failure = stderr || result.error?.message;
+    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure}`);
     return /* @__PURE__ */ new Set();
   }
   failure = void 0;
@@ -110828,6 +110863,29 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+function openAICompatibleLimit() {
+  return {
+    context: Number(process.env[OPENAI_COMPATIBLE_CONTEXT_ENV]),
+    output: Number(process.env[OPENAI_COMPATIBLE_MAX_OUTPUT_ENV])
+  };
+}
+function openAICompatibleProvider(model) {
+  const prefix = `${OPENAI_COMPATIBLE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const modelId = model.slice(prefix.length);
+  return {
+    [OPENAI_COMPATIBLE_PROVIDER]: {
+      npm: "@ai-sdk/openai-compatible",
+      name: "OpenAI-compatible",
+      options: {
+        // trailing slash would double up against opencode's `/chat/completions` join
+        baseURL: process.env[OPENAI_COMPATIBLE_BASE_URL_ENV]?.replace(/\/$/, ""),
+        apiKey: process.env[OPENAI_COMPATIBLE_API_KEY_ENV]
+      },
+      models: { [modelId]: { name: modelId, limit: openAICompatibleLimit() } }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -110919,7 +110977,8 @@ function buildSecurityConfig(ctx, model) {
       google: { models: geminiHighThinkingOverrides() },
       openrouter: {
         models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
-      }
+      },
+      ...openAICompatibleProvider(model)
     }
   };
   if (model) {
@@ -159914,6 +159973,9 @@ var JsonPayload = type({
     id: "string",
     type: "'issue' | 'review'"
   }).or("undefined"),
+  // optional so a payload from an older server build (pre-`checkRun`) still parses
+  // against a newer action across a rolling deploy.
+  "checkRun?": type({ id: "string" }).or("undefined"),
   "generateSummary?": "boolean | undefined"
 });
 var COLLABORATOR_PERMISSIONS = ["admin", "maintain", "write"];
@@ -160027,13 +160089,19 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     timeout: inputs.timeout ?? jsonPayload?.timeout,
     cwd: resolveCwd(inputs.cwd),
     progressComment: jsonPayload?.progressComment,
+    checkRun: jsonPayload?.checkRun,
     generateSummary: jsonPayload?.generateSummary,
     // permissions: inputs > repoSettings > fallbacks
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
-    // opt-in commit-status check-runs (branch protection). workflow-level
-    // static input, off unless the repo's pullfrog.yml sets status_checks: enabled.
-    statusChecks: inputs.status_checks === "enabled",
+    // the `pullfrog` run-lifecycle check. ON by default — the whole point is that a PR
+    // shows whether Pullfrog is running without anyone having to opt in. the workflow
+    // input is the source of truth when set (mirrors `push`); otherwise the repo
+    // setting decides.
+    runStatusCheck: inputs.status_checks === void 0 ? repoSettings.statusChecks : inputs.status_checks === "enabled",
+    // the `pullfrog-approval` verdict check stays opt-in and workflow-only. it exists to
+    // be *required* by branch protection, so it must never turn itself on.
+    approvalCheck: inputs.status_checks === "enabled",
     // temporary progress chrome. the workflow input is the source of truth when
     // set (mirrors `push`); otherwise the repo setting decides. defaults to true.
     progressComments: inputs.progress_comments === void 0 ? repoSettings.progressComments : inputs.progress_comments === "enabled",
@@ -160561,7 +160629,11 @@ async function approveAfterFix(ctx) {
     approved: true,
     hasComments: false
   });
-  ctx.toolState.approval = { wouldApprove: true, sha: headSha };
+  ctx.toolState.approval = {
+    wouldApprove: true,
+    sha: headSha,
+    url: result.data.html_url
+  };
   log.info(`\xBB auto-approved #${pullNumber} after fix run (review ${result.data.id})`);
   await deleteProgressComment(ctx).catch((err) => {
     log.debug(`progress comment cleanup after fix auto-approval failed: ${err}`);
@@ -160894,6 +160966,7 @@ function CreatePullRequestReviewTool(ctx) {
         }
         const reviewId = result.data.id;
         const reviewNodeId = result.data.node_id;
+        if (ctx.toolState.approval) ctx.toolState.approval.url = result.data.html_url;
         log.info(`\xBB created review ${reviewId} on pull request #${pull_number}`);
         const actuallyReviewedSha = primary.checkoutSha ?? params.commit_id;
         ctx.toolState.review = {
@@ -165185,6 +165258,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "openai-compatible") {
+    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
+    if (!modelId) {
+      throw new Error(
+        `${OPENAI_COMPATIBLE_MODEL_ENV} env var is required when the model is set to "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
+      );
+    }
+    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
+  }
   return resolveCliModel(slug2);
 }
 function resolveModel(ctx) {
@@ -165234,6 +165316,21 @@ function resolveAgent(ctx) {
 
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
+var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
+function buildKeyError(params) {
+  return params.secretsUnavailable ? buildSecretsUnavailableError(params) : buildMissingApiKeyError(params);
+}
+function buildSecretsUnavailableError(params) {
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  const modelClause = params.model ? ` needed for \`${params.model}\`` : "";
+  return [
+    `**Pullfrog ${SECRETS_UNAVAILABLE_MARKER}${modelClause} on this run.** The key is still stored \u2014 the runner just couldn't fetch it, so this is a transient failure on our side, not a missing key.`,
+    "",
+    "**To fix:** re-run the job. If it keeps happening, tell us in Discord.",
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+  ].join("\n");
+}
 function buildMissingApiKeyError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
@@ -165276,10 +165373,47 @@ add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then
 
 for full setup instructions, see https://docs.pullfrog.com/vertex`;
 }
+function buildOpenAICompatibleSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `OpenAI-compatible model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. everything else is plain workflow \`env:\`:
+
+  ${OPENAI_COMPATIBLE_BASE_URL_ENV}: https://your-endpoint.example.com/v1
+  ${OPENAI_COMPATIBLE_API_KEY_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_API_KEY_ENV} }}
+  ${OPENAI_COMPATIBLE_MODEL_ENV}: <model-id>
+  ${OPENAI_COMPATIBLE_CONTEXT_ENV}: "128000"
+  ${OPENAI_COMPATIBLE_MAX_OUTPUT_ENV}: "16384"
+
+set the last two to the real limits of the model your endpoint serves. Pullfrog can't
+discover them \u2014 your endpoint owns the model catalog \u2014 and without them completions are
+capped at 32000 tokens (rejected outright by models with a smaller cap) and
+auto-compaction is disabled, so long runs grow until your endpoint refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function hasPositiveNumberEnvVar(name) {
+  return Number(process.env[name]) > 0;
+}
+function validateOpenAICompatibleSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_CONTEXT_ENV))
+    missing.push(OPENAI_COMPATIBLE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV))
+    missing.push(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(
+      buildOpenAICompatibleSetupError({ owner: params.owner, name: params.name, missing })
+    );
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -165314,6 +165448,10 @@ function validateAgentApiKey(params) {
       validateVertexSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`)) {
+      validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -165326,23 +165464,46 @@ function validateAgentApiKey(params) {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
+      if (getModelEnvVars(params.model).some(hasEnvVar3)) return;
       throw new Error(
-        buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+        buildKeyError({
+          owner: params.owner,
+          name: params.name,
+          model: params.model,
+          secretsUnavailable: params.secretsUnavailable
+        })
       );
     }
     if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
     throw new Error(
-      buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        model: params.model,
+        secretsUnavailable: params.secretsUnavailable
+      })
     );
   }
   if (params.agent.name === "opencode") {
     if (params.authorized.size > 0) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
-    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+    throw new Error(
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        secretsUnavailable: params.secretsUnavailable
+      })
+    );
   }
   if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
-  throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  throw new Error(
+    buildKeyError({
+      owner: params.owner,
+      name: params.name,
+      secretsUnavailable: params.secretsUnavailable
+    })
+  );
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
@@ -166027,7 +166188,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/"));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -166822,6 +166983,7 @@ var defaultSettings = {
   autoMergeEnabled: false,
   signedCommits: false,
   progressComments: true,
+  statusChecks: true,
   modeInstructions: {},
   learnings: null,
   learningsHeadings: [],
@@ -166836,6 +166998,10 @@ var defaultRunContext = {
   oss: false,
   plan: "none"
 };
+var unknownSecretsRunContext = {
+  ...defaultRunContext,
+  secretsUnavailable: true
+};
 async function fetchRunContext(params) {
   const timeoutMs = 3e4;
   const controller = new AbortController();
@@ -166854,7 +167020,7 @@ async function fetchRunContext(params) {
     });
     clearTimeout(timeoutId);
     if (!response.ok) {
-      return defaultRunContext;
+      return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
     }
     const data = await response.json();
     if (data === null) {
@@ -166878,11 +167044,12 @@ async function fetchRunContext(params) {
       oss: data.oss ?? false,
       plan: data.plan ?? "none",
       proxyModel: data.proxyModel,
-      dbSecrets: data.dbSecrets
+      dbSecrets: data.dbSecrets,
+      secretsUnavailable: data.secretsUnavailable
     };
   } catch {
     clearTimeout(timeoutId);
-    return defaultRunContext;
+    return unknownSecretsRunContext;
   }
 }
 
@@ -166904,7 +167071,10 @@ async function resolveRunContextData(params) {
   const repoContext = parseRepoContext();
   let oidcToken;
   try {
-    oidcToken = await core9.getIDToken("pullfrog-api");
+    oidcToken = await op(() => core9.getIDToken("pullfrog-api"), {
+      name: "OIDC mint",
+      retries: process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? [200, 1e3] : []
+    })();
   } catch {
   }
   const [repoResponse, runContext] = await Promise.all([
@@ -166926,7 +167096,10 @@ async function resolveRunContextData(params) {
     oss: runContext.oss,
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
-    dbSecrets: runContext.dbSecrets
+    dbSecrets: runContext.dbSecrets,
+    // a failed mint on a runner that should have been able to mint is the same
+    // outcome as the server-side failure: the run never sees stored secrets.
+    secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0
   };
 }
 
@@ -167091,6 +167264,9 @@ function renderRunError(input) {
   if (input.errorMessage.includes(MODEL_ACCESS_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
+  if (input.errorMessage.includes(SECRETS_UNAVAILABLE_MARKER)) {
+    return { summary: input.errorMessage, comment: input.errorMessage };
+  }
   const isHang = input.errorMessage.startsWith("activity timeout") || input.errorMessage.startsWith("agent still pending");
   const hangBody = isHang ? formatAgentHangBody({
     diagnostic: input.agentDiagnostic,
@@ -167329,30 +167505,123 @@ function getCurrentWorkflowFilename() {
   return match3?.[1] ?? "pullfrog.yml";
 }
 
-// utils/statusChecks.ts
-var COMPLETION_CHECK = "pullfrog";
-var APPROVAL_CHECK = "pullfrog-approval";
-async function createCheckRun(ctx, params) {
+// utils/runStatusCheck.ts
+var RUN_STATUS_CHECK_NAME = "Pullfrog";
+var APPROVAL_CHECK_NAME = "Pullfrog approval";
+function parseCheckRunId(raw2) {
+  if (!raw2?.id) return void 0;
+  const id = parseInt(raw2.id, 10);
+  if (Number.isNaN(id) || id <= 0) return void 0;
+  return id;
+}
+function disableCheckLine(owner, repo) {
+  const url4 = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
+  return `
+
+[Turn off this check \u2192](${url4}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+}
+var TERMINAL_OUTPUT = {
+  success: {
+    title: "Pullfrog run completed",
+    summary: "The Pullfrog run finished successfully."
+  },
+  failure: {
+    title: "Pullfrog run failed",
+    summary: "The Pullfrog run failed. See the run logs for details."
+  },
+  cancelled: {
+    title: "Pullfrog run cancelled",
+    summary: "The Pullfrog run was cancelled before it finished."
+  },
+  timed_out: {
+    title: "Pullfrog run timed out",
+    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+  },
+  action_required: {
+    title: "Pullfrog run needs attention",
+    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+  },
+  neutral: {
+    title: "Pullfrog run finished",
+    summary: "The Pullfrog run finished without a pass or fail outcome."
+  },
+  skipped: {
+    title: "Pullfrog run skipped",
+    summary: "This run was superseded by another Pullfrog run."
+  },
+  stale: {
+    title: "Pullfrog run didn't finish",
+    summary: "Pullfrog never received a completion signal for this run. See the run logs for details."
+  }
+};
+function terminalOutput(params) {
+  const base = TERMINAL_OUTPUT[params.conclusion];
+  const review = params.reviewUrl ? `
+
+[View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
+  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
+  return { title: base.title, summary: base.summary + review + disable };
+}
+async function finalizeRunStatusCheck(params) {
+  const updateParams = {
+    owner: params.owner,
+    repo: params.repo,
+    check_run_id: params.checkRunId,
+    status: "completed",
+    conclusion: params.conclusion,
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
+  };
+  if (params.detailsUrl) updateParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.update(updateParams);
+}
+async function createTerminalRunStatusCheck(params) {
   const createParams = {
-    owner: ctx.repo.owner,
-    repo: ctx.repo.name,
-    name: params.name,
+    owner: params.owner,
+    repo: params.repo,
+    name: RUN_STATUS_CHECK_NAME,
     head_sha: params.headSha,
     status: "completed",
     conclusion: params.conclusion,
-    output: { title: params.title, summary: params.summary }
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
   };
-  if (ctx.runId) {
-    createParams.details_url = `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}`;
-  }
-  await ctx.octokit.rest.checks.create(createParams);
-  log.info(`\xBB posted ${params.name} check (${params.conclusion}) on ${params.headSha.slice(0, 7)}`);
+  if (params.detailsUrl) createParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.create(createParams);
 }
+
+// utils/statusChecks.ts
 async function reportStatusChecks(ctx, params) {
-  if (!ctx.payload.statusChecks) return;
   const event = ctx.payload.event;
   const pullNumber = event.issue_number;
   if (event.is_pr !== true || typeof pullNumber !== "number") return;
+  const checkRunId = parseCheckRunId(ctx.payload.checkRun);
+  if (checkRunId === void 0 && !ctx.payload.runStatusCheck && !ctx.payload.approvalCheck) return;
+  const conclusion = params.runSucceeded ? "success" : "failure";
+  const detailsUrl = ctx.runId ? `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}` : void 0;
+  if (checkRunId !== void 0) {
+    await finalizeRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      checkRunId,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB finalized ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} finalize failed: ${err}`));
+  }
+  const approval = ctx.toolState.approval;
+  const needsApprovalCheck = ctx.payload.approvalCheck && params.runSucceeded && approval;
+  const needsFallbackRunCheck = ctx.payload.runStatusCheck && checkRunId === void 0;
+  if (!needsApprovalCheck && !needsFallbackRunCheck) return;
   let headSha;
   try {
     const pr = await ctx.octokit.rest.pulls.get({
@@ -167365,24 +167634,32 @@ async function reportStatusChecks(ctx, params) {
     log.debug(`status checks: failed to resolve PR #${pullNumber} head sha: ${err}`);
     return;
   }
-  const completionSha = primaryRepoState(ctx.toolState).checkoutSha ?? headSha;
-  await createCheckRun(ctx, {
-    name: COMPLETION_CHECK,
-    headSha: completionSha,
-    conclusion: params.runSucceeded ? "success" : "failure",
-    title: params.runSucceeded ? "Pullfrog run completed" : "Pullfrog run failed",
-    summary: params.runSucceeded ? "The Pullfrog run finished successfully." : "The Pullfrog run failed or timed out. See the run logs for details."
-  }).catch((err) => log.debug(`status checks: ${COMPLETION_CHECK} post failed: ${err}`));
-  const approval = ctx.toolState.approval;
-  if (params.runSucceeded && approval) {
-    await createCheckRun(ctx, {
-      name: APPROVAL_CHECK,
-      headSha: approval.sha ?? headSha,
-      conclusion: approval.wouldApprove ? "success" : "failure",
+  if (needsFallbackRunCheck) {
+    await createTerminalRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      headSha: primaryRepoState(ctx.toolState).checkoutSha ?? headSha,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB posted ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} post failed: ${err}`));
+  }
+  if (!needsApprovalCheck || !approval) return;
+  const createParams = {
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    name: APPROVAL_CHECK_NAME,
+    head_sha: approval.sha ?? headSha,
+    status: "completed",
+    conclusion: approval.wouldApprove ? "success" : "failure",
+    output: {
       title: approval.wouldApprove ? "Pullfrog would approve" : "Pullfrog would not approve",
       summary: approval.wouldApprove ? "Pullfrog has no outstanding review feedback on this PR." : "Pullfrog has outstanding review feedback or requested changes on this PR."
-    }).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK} post failed: ${err}`));
-  }
+    }
+  };
+  if (detailsUrl) createParams.details_url = detailsUrl;
+  await ctx.octokit.rest.checks.create(createParams).then(() => log.info(`\xBB posted ${APPROVAL_CHECK_NAME} check`)).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK_NAME} post failed: ${err}`));
 }
 
 // utils/runLifecycle.ts
@@ -167825,7 +168102,8 @@ async function main() {
             model: effectiveModel,
             authorized: getAuthorizedModels(),
             owner: runContext.repo.owner,
-            name: runContext.repo.name
+            name: runContext.repo.name,
+            secretsUnavailable: runContext.secretsUnavailable
           });
         }
         await setupGit({
@@ -168322,7 +168600,7 @@ function link(text, url4) {
   return `\x1B]8;;${url4}\x07${text}\x1B]8;;\x07`;
 }
 function buildProviders() {
-  return Object.entries(providers).filter(([key]) => key !== "opencode" && key !== "openrouter" && key !== "bedrock").map(([key, config3]) => {
+  return Object.entries(providers).filter(([key]) => key !== "opencode" && key !== "openrouter").map(([key, config3]) => {
     const aliases = modelAliases.filter(
       (a) => a.provider === key && !a.fallback && !a.routing && !a.hidden
     );
@@ -168342,7 +168620,7 @@ function buildProviders() {
         hint: a === recommended ? "recommended" : void 0
       }))
     };
-  });
+  }).filter((p2) => p2.models.length > 0);
 }
 var CLI_PROVIDERS = buildProviders();
 function resolveModelProvider(slug2) {
@@ -168782,7 +169060,8 @@ async function handleSecret(ctx) {
   }
   if (method === "pullfrog") {
     const scope2 = ctx.secrets.isOrg ? await promptScope2(ctx) : "account";
-    activeSpin2.start(`saving ${envVar}`);
+    const target = describeSecretTarget({ owner: ctx.owner, repo: ctx.repo, scope: scope2 });
+    activeSpin2.start(`saving ${import_picocolors3.default.cyan(envVar)} to ${target}`);
     let saveResult;
     try {
       saveResult = await setPullfrogSecret2({
@@ -168802,7 +169081,7 @@ async function handleSecret(ctx) {
       return;
     }
     if (saveResult.saved) {
-      activeSpin2.stop(`saved ${import_picocolors3.default.cyan(envVar)} to Pullfrog`);
+      activeSpin2.stop(`saved ${import_picocolors3.default.cyan(envVar)} to ${target}`);
     } else {
       activeSpin2.stop(import_picocolors3.default.red("could not save secret"));
       O2.warn(
@@ -169152,7 +169431,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.45";
+var VERSION10 = "0.1.47";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);