pullfrog 0.1.45 → 0.1.47

package/dist/external.d.ts

@@ -262,6 +262,14 @@ export interface WriteablePayload {
         id: string;
         type: "issue" | "review";
     } | undefined;
+    /**
+     * pre-created `pullfrog` check-run, seeded `in_progress` by the server at dispatch so
+     * the PR's checks list shows the run before the GHA runner boots. the action PATCHes
+     * it to a terminal conclusion at run end. see `action/utils/runStatusCheck.ts`.
+     */
+    checkRun?: {
+        id: string;
+    } | undefined;
     /** when true, seed the PR summary tmpfile + persist edits at run end */
     generateSummary?: boolean | undefined;
 }

package/dist/index.js

@@ -100190,6 +100190,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],
@@ -100407,6 +100429,12 @@ var DEFAULT_PROXY_MODEL = defaultProxyAlias.openRouterResolve;
 var defaultProxyDisplayName = defaultProxyAlias.displayName;
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+var OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+var OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+var OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 function isBedrockAnthropicId(bedrockModelId) {
   return bedrockModelId.toLowerCase().split(/[./:]/).includes("anthropic");
 }
@@ -101093,7 +101121,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.45",
+  version: "0.1.47",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -108882,8 +108910,9 @@ function readModels(cliPath) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
-    failure = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim() || void 0;
-    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure ?? result.error}`);
+    const stderr = (result.stderr ?? "").replace(ANSI_PATTERN, "").trim();
+    failure = stderr || result.error?.message;
+    log.debug(`\xBB \`opencode models\` failed (${result.status}): ${failure}`);
     return /* @__PURE__ */ new Set();
   }
   failure = void 0;
@@ -108941,6 +108970,29 @@ function geminiHighThinkingOverrides() {
     ])
   );
 }
+function openAICompatibleLimit() {
+  return {
+    context: Number(process.env[OPENAI_COMPATIBLE_CONTEXT_ENV]),
+    output: Number(process.env[OPENAI_COMPATIBLE_MAX_OUTPUT_ENV])
+  };
+}
+function openAICompatibleProvider(model) {
+  const prefix = `${OPENAI_COMPATIBLE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const modelId = model.slice(prefix.length);
+  return {
+    [OPENAI_COMPATIBLE_PROVIDER]: {
+      npm: "@ai-sdk/openai-compatible",
+      name: "OpenAI-compatible",
+      options: {
+        // trailing slash would double up against opencode's `/chat/completions` join
+        baseURL: process.env[OPENAI_COMPATIBLE_BASE_URL_ENV]?.replace(/\/$/, ""),
+        apiKey: process.env[OPENAI_COMPATIBLE_API_KEY_ENV]
+      },
+      models: { [modelId]: { name: modelId, limit: openAICompatibleLimit() } }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -109032,7 +109084,8 @@ function buildSecurityConfig(ctx, model) {
       google: { models: geminiHighThinkingOverrides() },
       openrouter: {
         models: { ...deepseekHighEffortOverrides(), ...kimiOpenRouterProviderOverrides() }
-      }
+      },
+      ...openAICompatibleProvider(model)
     }
   };
   if (model) {
@@ -158027,6 +158080,9 @@ var JsonPayload = type({
     id: "string",
     type: "'issue' | 'review'"
   }).or("undefined"),
+  // optional so a payload from an older server build (pre-`checkRun`) still parses
+  // against a newer action across a rolling deploy.
+  "checkRun?": type({ id: "string" }).or("undefined"),
   "generateSummary?": "boolean | undefined"
 });
 var COLLABORATOR_PERMISSIONS = ["admin", "maintain", "write"];
@@ -158140,13 +158196,19 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     timeout: inputs.timeout ?? jsonPayload?.timeout,
     cwd: resolveCwd(inputs.cwd),
     progressComment: jsonPayload?.progressComment,
+    checkRun: jsonPayload?.checkRun,
     generateSummary: jsonPayload?.generateSummary,
     // permissions: inputs > repoSettings > fallbacks
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
-    // opt-in commit-status check-runs (branch protection). workflow-level
-    // static input, off unless the repo's pullfrog.yml sets status_checks: enabled.
-    statusChecks: inputs.status_checks === "enabled",
+    // the `pullfrog` run-lifecycle check. ON by default — the whole point is that a PR
+    // shows whether Pullfrog is running without anyone having to opt in. the workflow
+    // input is the source of truth when set (mirrors `push`); otherwise the repo
+    // setting decides.
+    runStatusCheck: inputs.status_checks === void 0 ? repoSettings.statusChecks : inputs.status_checks === "enabled",
+    // the `pullfrog-approval` verdict check stays opt-in and workflow-only. it exists to
+    // be *required* by branch protection, so it must never turn itself on.
+    approvalCheck: inputs.status_checks === "enabled",
     // temporary progress chrome. the workflow input is the source of truth when
     // set (mirrors `push`); otherwise the repo setting decides. defaults to true.
     progressComments: inputs.progress_comments === void 0 ? repoSettings.progressComments : inputs.progress_comments === "enabled",
@@ -158674,7 +158736,11 @@ async function approveAfterFix(ctx) {
     approved: true,
     hasComments: false
   });
-  ctx.toolState.approval = { wouldApprove: true, sha: headSha };
+  ctx.toolState.approval = {
+    wouldApprove: true,
+    sha: headSha,
+    url: result.data.html_url
+  };
   log.info(`\xBB auto-approved #${pullNumber} after fix run (review ${result.data.id})`);
   await deleteProgressComment(ctx).catch((err) => {
     log.debug(`progress comment cleanup after fix auto-approval failed: ${err}`);
@@ -159007,6 +159073,7 @@ function CreatePullRequestReviewTool(ctx) {
         }
         const reviewId = result.data.id;
         const reviewNodeId = result.data.node_id;
+        if (ctx.toolState.approval) ctx.toolState.approval.url = result.data.html_url;
         log.info(`\xBB created review ${reviewId} on pull request #${pull_number}`);
         const actuallyReviewedSha = primary.checkoutSha ?? params.commit_id;
         ctx.toolState.review = {
@@ -163298,6 +163365,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "openai-compatible") {
+    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
+    if (!modelId) {
+      throw new Error(
+        `${OPENAI_COMPATIBLE_MODEL_ENV} env var is required when the model is set to "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
+      );
+    }
+    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
+  }
   return resolveCliModel(slug2);
 }
 function resolveModel(ctx) {
@@ -163347,6 +163423,21 @@ function resolveAgent(ctx) {
 
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
+var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
+function buildKeyError(params) {
+  return params.secretsUnavailable ? buildSecretsUnavailableError(params) : buildMissingApiKeyError(params);
+}
+function buildSecretsUnavailableError(params) {
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  const modelClause = params.model ? ` needed for \`${params.model}\`` : "";
+  return [
+    `**Pullfrog ${SECRETS_UNAVAILABLE_MARKER}${modelClause} on this run.** The key is still stored \u2014 the runner just couldn't fetch it, so this is a transient failure on our side, not a missing key.`,
+    "",
+    "**To fix:** re-run the job. If it keeps happening, tell us in Discord.",
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+  ].join("\n");
+}
 function buildMissingApiKeyError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
   const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
@@ -163389,10 +163480,47 @@ add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then
 
 for full setup instructions, see https://docs.pullfrog.com/vertex`;
 }
+function buildOpenAICompatibleSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `OpenAI-compatible model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. everything else is plain workflow \`env:\`:
+
+  ${OPENAI_COMPATIBLE_BASE_URL_ENV}: https://your-endpoint.example.com/v1
+  ${OPENAI_COMPATIBLE_API_KEY_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_API_KEY_ENV} }}
+  ${OPENAI_COMPATIBLE_MODEL_ENV}: <model-id>
+  ${OPENAI_COMPATIBLE_CONTEXT_ENV}: "128000"
+  ${OPENAI_COMPATIBLE_MAX_OUTPUT_ENV}: "16384"
+
+set the last two to the real limits of the model your endpoint serves. Pullfrog can't
+discover them \u2014 your endpoint owns the model catalog \u2014 and without them completions are
+capped at 32000 tokens (rejected outright by models with a smaller cap) and
+auto-compaction is disabled, so long runs grow until your endpoint refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function hasPositiveNumberEnvVar(name) {
+  return Number(process.env[name]) > 0;
+}
+function validateOpenAICompatibleSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
+  if (!hasEnvVar3(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_CONTEXT_ENV))
+    missing.push(OPENAI_COMPATIBLE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV))
+    missing.push(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(
+      buildOpenAICompatibleSetupError({ owner: params.owner, name: params.name, missing })
+    );
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -163427,6 +163555,10 @@ function validateAgentApiKey(params) {
       validateVertexSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`)) {
+      validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -163439,23 +163571,46 @@ function validateAgentApiKey(params) {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
+      if (getModelEnvVars(params.model).some(hasEnvVar3)) return;
       throw new Error(
-        buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+        buildKeyError({
+          owner: params.owner,
+          name: params.name,
+          model: params.model,
+          secretsUnavailable: params.secretsUnavailable
+        })
       );
     }
     if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
     throw new Error(
-      buildMissingApiKeyError({ owner: params.owner, name: params.name, model: params.model })
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        model: params.model,
+        secretsUnavailable: params.secretsUnavailable
+      })
     );
   }
   if (params.agent.name === "opencode") {
     if (params.authorized.size > 0) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
-    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+    throw new Error(
+      buildKeyError({
+        owner: params.owner,
+        name: params.name,
+        secretsUnavailable: params.secretsUnavailable
+      })
+    );
   }
   if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
-  throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  throw new Error(
+    buildKeyError({
+      owner: params.owner,
+      name: params.name,
+      secretsUnavailable: params.secretsUnavailable
+    })
+  );
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
@@ -164140,7 +164295,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/"));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -164935,6 +165090,7 @@ var defaultSettings = {
   autoMergeEnabled: false,
   signedCommits: false,
   progressComments: true,
+  statusChecks: true,
   modeInstructions: {},
   learnings: null,
   learningsHeadings: [],
@@ -164949,6 +165105,10 @@ var defaultRunContext = {
   oss: false,
   plan: "none"
 };
+var unknownSecretsRunContext = {
+  ...defaultRunContext,
+  secretsUnavailable: true
+};
 async function fetchRunContext(params) {
   const timeoutMs = 3e4;
   const controller = new AbortController();
@@ -164967,7 +165127,7 @@ async function fetchRunContext(params) {
     });
     clearTimeout(timeoutId);
     if (!response.ok) {
-      return defaultRunContext;
+      return response.status >= 500 ? unknownSecretsRunContext : defaultRunContext;
     }
     const data = await response.json();
     if (data === null) {
@@ -164991,11 +165151,12 @@ async function fetchRunContext(params) {
       oss: data.oss ?? false,
       plan: data.plan ?? "none",
       proxyModel: data.proxyModel,
-      dbSecrets: data.dbSecrets
+      dbSecrets: data.dbSecrets,
+      secretsUnavailable: data.secretsUnavailable
     };
   } catch {
     clearTimeout(timeoutId);
-    return defaultRunContext;
+    return unknownSecretsRunContext;
   }
 }
 
@@ -165017,7 +165178,10 @@ async function resolveRunContextData(params) {
   const repoContext = parseRepoContext();
   let oidcToken;
   try {
-    oidcToken = await core9.getIDToken("pullfrog-api");
+    oidcToken = await op(() => core9.getIDToken("pullfrog-api"), {
+      name: "OIDC mint",
+      retries: process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? [200, 1e3] : []
+    })();
   } catch {
   }
   const [repoResponse, runContext] = await Promise.all([
@@ -165039,7 +165203,10 @@ async function resolveRunContextData(params) {
     oss: runContext.oss,
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
-    dbSecrets: runContext.dbSecrets
+    dbSecrets: runContext.dbSecrets,
+    // a failed mint on a runner that should have been able to mint is the same
+    // outcome as the server-side failure: the run never sees stored secrets.
+    secretsUnavailable: runContext.secretsUnavailable || !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL && oidcToken === void 0
   };
 }
 
@@ -165204,6 +165371,9 @@ function renderRunError(input) {
   if (input.errorMessage.includes(MODEL_ACCESS_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
+  if (input.errorMessage.includes(SECRETS_UNAVAILABLE_MARKER)) {
+    return { summary: input.errorMessage, comment: input.errorMessage };
+  }
   const isHang = input.errorMessage.startsWith("activity timeout") || input.errorMessage.startsWith("agent still pending");
   const hangBody = isHang ? formatAgentHangBody({
     diagnostic: input.agentDiagnostic,
@@ -165442,30 +165612,123 @@ function getCurrentWorkflowFilename() {
   return match3?.[1] ?? "pullfrog.yml";
 }
 
-// utils/statusChecks.ts
-var COMPLETION_CHECK = "pullfrog";
-var APPROVAL_CHECK = "pullfrog-approval";
-async function createCheckRun(ctx, params) {
+// utils/runStatusCheck.ts
+var RUN_STATUS_CHECK_NAME = "Pullfrog";
+var APPROVAL_CHECK_NAME = "Pullfrog approval";
+function parseCheckRunId(raw2) {
+  if (!raw2?.id) return void 0;
+  const id = parseInt(raw2.id, 10);
+  if (Number.isNaN(id) || id <= 0) return void 0;
+  return id;
+}
+function disableCheckLine(owner, repo) {
+  const url4 = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
+  return `
+
+[Turn off this check \u2192](${url4}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+}
+var TERMINAL_OUTPUT = {
+  success: {
+    title: "Pullfrog run completed",
+    summary: "The Pullfrog run finished successfully."
+  },
+  failure: {
+    title: "Pullfrog run failed",
+    summary: "The Pullfrog run failed. See the run logs for details."
+  },
+  cancelled: {
+    title: "Pullfrog run cancelled",
+    summary: "The Pullfrog run was cancelled before it finished."
+  },
+  timed_out: {
+    title: "Pullfrog run timed out",
+    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+  },
+  action_required: {
+    title: "Pullfrog run needs attention",
+    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+  },
+  neutral: {
+    title: "Pullfrog run finished",
+    summary: "The Pullfrog run finished without a pass or fail outcome."
+  },
+  skipped: {
+    title: "Pullfrog run skipped",
+    summary: "This run was superseded by another Pullfrog run."
+  },
+  stale: {
+    title: "Pullfrog run didn't finish",
+    summary: "Pullfrog never received a completion signal for this run. See the run logs for details."
+  }
+};
+function terminalOutput(params) {
+  const base = TERMINAL_OUTPUT[params.conclusion];
+  const review = params.reviewUrl ? `
+
+[View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
+  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
+  return { title: base.title, summary: base.summary + review + disable };
+}
+async function finalizeRunStatusCheck(params) {
+  const updateParams = {
+    owner: params.owner,
+    repo: params.repo,
+    check_run_id: params.checkRunId,
+    status: "completed",
+    conclusion: params.conclusion,
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
+  };
+  if (params.detailsUrl) updateParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.update(updateParams);
+}
+async function createTerminalRunStatusCheck(params) {
   const createParams = {
-    owner: ctx.repo.owner,
-    repo: ctx.repo.name,
-    name: params.name,
+    owner: params.owner,
+    repo: params.repo,
+    name: RUN_STATUS_CHECK_NAME,
     head_sha: params.headSha,
     status: "completed",
     conclusion: params.conclusion,
-    output: { title: params.title, summary: params.summary }
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
   };
-  if (ctx.runId) {
-    createParams.details_url = `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}`;
-  }
-  await ctx.octokit.rest.checks.create(createParams);
-  log.info(`\xBB posted ${params.name} check (${params.conclusion}) on ${params.headSha.slice(0, 7)}`);
+  if (params.detailsUrl) createParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.create(createParams);
 }
+
+// utils/statusChecks.ts
 async function reportStatusChecks(ctx, params) {
-  if (!ctx.payload.statusChecks) return;
   const event = ctx.payload.event;
   const pullNumber = event.issue_number;
   if (event.is_pr !== true || typeof pullNumber !== "number") return;
+  const checkRunId = parseCheckRunId(ctx.payload.checkRun);
+  if (checkRunId === void 0 && !ctx.payload.runStatusCheck && !ctx.payload.approvalCheck) return;
+  const conclusion = params.runSucceeded ? "success" : "failure";
+  const detailsUrl = ctx.runId ? `https://github.com/${ctx.repo.owner}/${ctx.repo.name}/actions/runs/${ctx.runId}` : void 0;
+  if (checkRunId !== void 0) {
+    await finalizeRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      checkRunId,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB finalized ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} finalize failed: ${err}`));
+  }
+  const approval = ctx.toolState.approval;
+  const needsApprovalCheck = ctx.payload.approvalCheck && params.runSucceeded && approval;
+  const needsFallbackRunCheck = ctx.payload.runStatusCheck && checkRunId === void 0;
+  if (!needsApprovalCheck && !needsFallbackRunCheck) return;
   let headSha;
   try {
     const pr = await ctx.octokit.rest.pulls.get({
@@ -165478,24 +165741,32 @@ async function reportStatusChecks(ctx, params) {
     log.debug(`status checks: failed to resolve PR #${pullNumber} head sha: ${err}`);
     return;
   }
-  const completionSha = primaryRepoState(ctx.toolState).checkoutSha ?? headSha;
-  await createCheckRun(ctx, {
-    name: COMPLETION_CHECK,
-    headSha: completionSha,
-    conclusion: params.runSucceeded ? "success" : "failure",
-    title: params.runSucceeded ? "Pullfrog run completed" : "Pullfrog run failed",
-    summary: params.runSucceeded ? "The Pullfrog run finished successfully." : "The Pullfrog run failed or timed out. See the run logs for details."
-  }).catch((err) => log.debug(`status checks: ${COMPLETION_CHECK} post failed: ${err}`));
-  const approval = ctx.toolState.approval;
-  if (params.runSucceeded && approval) {
-    await createCheckRun(ctx, {
-      name: APPROVAL_CHECK,
-      headSha: approval.sha ?? headSha,
-      conclusion: approval.wouldApprove ? "success" : "failure",
+  if (needsFallbackRunCheck) {
+    await createTerminalRunStatusCheck({
+      octokit: ctx.octokit,
+      owner: ctx.repo.owner,
+      repo: ctx.repo.name,
+      headSha: primaryRepoState(ctx.toolState).checkoutSha ?? headSha,
+      conclusion,
+      detailsUrl,
+      reviewUrl: ctx.toolState.approval?.url
+    }).then(() => log.info(`\xBB posted ${RUN_STATUS_CHECK_NAME} check (${conclusion})`)).catch((err) => log.debug(`status checks: ${RUN_STATUS_CHECK_NAME} post failed: ${err}`));
+  }
+  if (!needsApprovalCheck || !approval) return;
+  const createParams = {
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    name: APPROVAL_CHECK_NAME,
+    head_sha: approval.sha ?? headSha,
+    status: "completed",
+    conclusion: approval.wouldApprove ? "success" : "failure",
+    output: {
       title: approval.wouldApprove ? "Pullfrog would approve" : "Pullfrog would not approve",
       summary: approval.wouldApprove ? "Pullfrog has no outstanding review feedback on this PR." : "Pullfrog has outstanding review feedback or requested changes on this PR."
-    }).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK} post failed: ${err}`));
-  }
+    }
+  };
+  if (detailsUrl) createParams.details_url = detailsUrl;
+  await ctx.octokit.rest.checks.create(createParams).then(() => log.info(`\xBB posted ${APPROVAL_CHECK_NAME} check`)).catch((err) => log.debug(`status checks: ${APPROVAL_CHECK_NAME} post failed: ${err}`));
 }
 
 // utils/runLifecycle.ts
@@ -165938,7 +166209,8 @@ async function main() {
             model: effectiveModel,
             authorized: getAuthorizedModels(),
             owner: runContext.repo.owner,
-            name: runContext.repo.name
+            name: runContext.repo.name,
+            secretsUnavailable: runContext.secretsUnavailable
           });
         }
         await setupGit({

package/dist/internal/index.d.ts

@@ -15,4 +15,6 @@ export { isLeapingIntoActionCommentBody, LEAPING_INTO_ACTION_PREFIX, } from "../
 export { MAX_LEARNINGS_LENGTH, truncateAtLineBoundary } from "../utils/learningsTruncate.ts";
 export type { CreateProgressCommentTarget, ProgressComment, ProgressCommentType, } from "../utils/progressComment.ts";
 export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComment, updateProgressComment, } from "../utils/progressComment.ts";
+export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
+export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";