pullfrog 0.1.45 → 0.1.47

package/dist/internal.js

@@ -381,6 +381,28 @@ var providers = {
       }
     }
   }),
+  "openai-compatible": provider({
+    // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
+    // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
+    // different wire format, say) slots in beside it without a rename. the
+    // provider KEY stays `openai-compatible` — it's the stored slug and the
+    // `OPENAI_COMPATIBLE_*` env prefix, so this is display-only.
+    displayName: "Custom",
+    // bring-your-own generic OpenAI-compatible endpoint — Cloudflare AI Gateway,
+    // Alibaba DashScope, self-hosted vLLM, or any compatible gateway. base URL +
+    // key + model ID are all supplied via env; nothing is cataloged or bumped.
+    envVars: ["OPENAI_COMPATIBLE_BASE_URL", "OPENAI_COMPATIBLE_API_KEY", "OPENAI_COMPATIBLE_MODEL"],
+    models: {
+      // single routing entry — the actual model ID is read from
+      // OPENAI_COMPATIBLE_MODEL at run time and the provider is materialized
+      // via `@ai-sdk/openai-compatible`.
+      byok: {
+        displayName: "OpenAI-compatible",
+        resolve: "openai-compatible",
+        routing: "openai-compatible"
+      }
+    }
+  }),
   openrouter: provider({
     displayName: "OpenRouter",
     envVars: ["OPENROUTER_API_KEY"],
@@ -1307,6 +1329,113 @@ async function createLeapingProgressComment(ctx, target, body) {
   };
 }
 
+// utils/runStatusCheck.ts
+var RUN_STATUS_CHECK_NAME = "Pullfrog";
+var APPROVAL_CHECK_NAME = "Pullfrog approval";
+var IN_PROGRESS_OUTPUT = {
+  title: "Pullfrog is running",
+  summary: "Pullfrog is working on this pull request. This check updates when the run finishes."
+};
+function disableCheckLine(owner, repo) {
+  const url = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
+  return `
+
+[Turn off this check \u2192](${url}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+}
+var TERMINAL_OUTPUT = {
+  success: {
+    title: "Pullfrog run completed",
+    summary: "The Pullfrog run finished successfully."
+  },
+  failure: {
+    title: "Pullfrog run failed",
+    summary: "The Pullfrog run failed. See the run logs for details."
+  },
+  cancelled: {
+    title: "Pullfrog run cancelled",
+    summary: "The Pullfrog run was cancelled before it finished."
+  },
+  timed_out: {
+    title: "Pullfrog run timed out",
+    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+  },
+  action_required: {
+    title: "Pullfrog run needs attention",
+    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+  },
+  neutral: {
+    title: "Pullfrog run finished",
+    summary: "The Pullfrog run finished without a pass or fail outcome."
+  },
+  skipped: {
+    title: "Pullfrog run skipped",
+    summary: "This run was superseded by another Pullfrog run."
+  },
+  stale: {
+    title: "Pullfrog run didn't finish",
+    summary: "Pullfrog never received a completion signal for this run. See the run logs for details."
+  }
+};
+function terminalOutput(params) {
+  const base = TERMINAL_OUTPUT[params.conclusion];
+  const review = params.reviewUrl ? `
+
+[View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
+  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
+  return { title: base.title, summary: base.summary + review + disable };
+}
+async function createRunStatusCheck(params) {
+  const existing = await params.octokit.rest.checks.listForRef({
+    owner: params.owner,
+    repo: params.repo,
+    ref: params.headSha,
+    check_name: RUN_STATUS_CHECK_NAME,
+    status: "in_progress"
+  }).catch(() => void 0);
+  const reusable = existing?.data.check_runs[0];
+  if (reusable) return reusable.id;
+  const createParams = {
+    owner: params.owner,
+    repo: params.repo,
+    name: RUN_STATUS_CHECK_NAME,
+    head_sha: params.headSha,
+    status: "in_progress",
+    output: IN_PROGRESS_OUTPUT
+  };
+  if (params.detailsUrl) createParams.details_url = params.detailsUrl;
+  const created = await params.octokit.rest.checks.create(createParams);
+  return created.data.id;
+}
+async function finalizeRunStatusCheck(params) {
+  const updateParams = {
+    owner: params.owner,
+    repo: params.repo,
+    check_run_id: params.checkRunId,
+    status: "completed",
+    conclusion: params.conclusion,
+    output: terminalOutput({
+      conclusion: params.conclusion,
+      owner: params.owner,
+      repo: params.repo,
+      reviewUrl: params.reviewUrl
+    })
+  };
+  if (params.detailsUrl) updateParams.details_url = params.detailsUrl;
+  await params.octokit.rest.checks.update(updateParams);
+}
+async function runStatusCheckNeedsFinalizing(params) {
+  try {
+    const existing = await params.octokit.rest.checks.get({
+      owner: params.owner,
+      repo: params.repo,
+      check_run_id: params.checkRunId
+    });
+    return existing.data.status !== "completed";
+  } catch {
+    return false;
+  }
+}
+
 // utils/time.ts
 var TIMEOUT_DISABLED = "none";
 var TIME_STRING_REGEX = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
@@ -1322,6 +1451,7 @@ function isValidTimeString(input) {
   return parseTimeString(input) !== null;
 }
 export {
+  APPROVAL_CHECK_NAME,
   AUTO_EFFICIENT,
   AUTO_INTELLIGENT,
   DEFAULT_PROXY_MODEL,
@@ -1329,12 +1459,15 @@ export {
   MAX_LEARNINGS_LENGTH,
   OAuthInvalidGrantError,
   PULLFROG_DIVIDER,
+  RUN_STATUS_CHECK_NAME,
   TIMEOUT_DISABLED,
   buildPullfrogFooter,
   createLeapingProgressComment,
+  createRunStatusCheck,
   decodeJwtExpMs,
   defaultAutoTier,
   deleteProgressCommentApi,
+  finalizeRunStatusCheck,
   getAutoSelectHintModel,
   getModelEnvVars,
   getModelManagedCredentials,
@@ -1358,6 +1491,7 @@ export {
   resolveDisplayAlias,
   resolveModelSlug,
   resolveOpenRouterModel,
+  runStatusCheckNeedsFinalizing,
   stringifyCodexAuthBody,
   stripExistingFooter,
   truncateAtLineBoundary,

package/dist/models.d.ts

@@ -20,7 +20,7 @@
  * env var and routes to claude-code for Anthropic IDs or opencode for
  * everything else.
  */
-export type ModelRouting = "bedrock" | "vertex";
+export type ModelRouting = "bedrock" | "vertex" | "openai-compatible";
 export interface ModelAlias {
     /** stable alias stored in DB, e.g. "anthropic/claude-opus" */
     slug: string;
@@ -99,6 +99,7 @@ export declare const providers: {
     "opencode-go": ProviderConfig;
     bedrock: ProviderConfig;
     vertex: ProviderConfig;
+    "openai-compatible": ProviderConfig;
     openrouter: ProviderConfig;
 };
 export type ModelProvider = keyof typeof providers;
@@ -196,6 +197,31 @@ export declare function getAutoSelectHintModel(): string;
 export declare const BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 /** env var that supplies the Vertex AI model ID for the `vertex/byok` slug. */
 export declare const VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+/** provider key + slug prefix for the generic OpenAI-compatible BYOK backend. */
+export declare const OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+/** base URL of the user's OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway URL). */
+export declare const OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+/** API key/token for the user's OpenAI-compatible endpoint — the one sensitive secret. */
+export declare const OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+/** model ID served by the endpoint, supplied for the `openai-compatible/byok` slug. */
+export declare const OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
+/**
+ * context-window size of the endpoint's model. required — `validateOpenAICompatibleSetup`
+ * rejects the run pre-agent when it's unset or non-numeric. it also gates
+ * auto-compaction: opencode's `isOverflow` short-circuits when
+ * `limit.context === 0`, which would otherwise let a long session grow until the
+ * endpoint rejects it on context length.
+ */
+export declare const OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
+/**
+ * max completion tokens the endpoint's model accepts. required — see
+ * OPENAI_COMPATIBLE_CONTEXT_ENV. opencode has no models.dev metadata for a
+ * user-supplied endpoint, and an undeclared limit makes it send
+ * `max_tokens: 32000`, which most models reject outright (gpt-4o and gpt-4o-mini
+ * cap at 16384, many open models at 4096/8192). opencode's `limit` requires
+ * `context` + `output` together, so the pair is validated and emitted as a unit.
+ */
+export declare const OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
 /**
  * the Bedrock model ID passed to claude-code or opencode is whatever the
  * user set in `BEDROCK_MODEL_ID` — Pullfrog never resolves or upgrades it.

package/dist/toolState.d.ts

@@ -104,6 +104,7 @@ export interface ToolState {
     approval?: {
         wouldApprove: boolean;
         sha: string | undefined;
+        url?: string | undefined;
     };
     reviewReplies?: Map<number, {
         commentId: number;

package/dist/utils/apiKeys.d.ts

@@ -1,3 +1,10 @@
+/**
+ * marker for the distinct "run-context couldn't hand over your stored secrets"
+ * body. surfaced verbatim by `runErrorRenderer` (same contract as
+ * `MODEL_ACCESS_MARKER`) because blaming the user for a transient fetch failure
+ * on our side is the wrong CTA — their key is configured and still stored.
+ */
+export declare const SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
 /**
  * Validate that the resolved model can actually be served by the chosen
  * agent. For routing slugs (Bedrock / Vertex) the auth shape is multi-var
@@ -16,6 +23,9 @@ export declare function validateAgentApiKey(params: {
     authorized: Set<string>;
     owner: string;
     name: string;
+    /** run-context couldn't hand over Pullfrog-stored secrets, so a missing key
+     * says nothing about what the user actually configured. */
+    secretsUnavailable?: boolean | undefined;
 }): void;
 /**
  * Detect agent-runtime auth failures that should be reformatted as an actionable

package/dist/utils/payload.d.ts

@@ -22,6 +22,9 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
         id: string;
         type: "issue" | "review";
     } | undefined;
+    checkRun?: {
+        id: string;
+    } | undefined;
     generateSummary?: boolean | undefined;
 }, {}>;
 export declare const Inputs: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -68,10 +71,14 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
         id: string;
         type: "issue" | "review";
     } | undefined;
+    checkRun: {
+        id: string;
+    } | undefined;
     generateSummary: boolean | undefined;
     push: import("../external.ts").PushPermission;
     shell: import("../external.ts").ShellPermission;
-    statusChecks: boolean;
+    runStatusCheck: boolean;
+    approvalCheck: boolean;
     progressComments: boolean;
     proxyModel: string | undefined;
 };

package/dist/utils/runContext.d.ts

@@ -34,6 +34,7 @@ export interface RepoSettings {
     autoMergeEnabled: boolean;
     signedCommits: boolean;
     progressComments: boolean;
+    statusChecks: boolean;
     modeInstructions: Record<string, string>;
     learnings: string | null;
     learningsHeadings: LearningsHeading[];
@@ -55,6 +56,13 @@ export interface RunContext {
     plan: AccountPlan;
     proxyModel?: string | undefined;
     dbSecrets?: Record<string, string> | undefined;
+    /**
+     * the server tried and failed to materialize Pullfrog-stored secrets (or we
+     * never got a usable response at all). distinct from an absent `dbSecrets`,
+     * which legitimately means the user has none stored — without the
+     * distinction a transient failure renders as "you have no API key".
+     */
+    secretsUnavailable?: boolean | undefined;
 }
 /**
  * fetch run context from Pullfrog API

package/dist/utils/runContextData.d.ts

@@ -13,6 +13,9 @@ export interface RunContextData {
     plan: AccountPlan;
     proxyModel?: string | undefined;
     dbSecrets?: Record<string, string> | undefined;
+    /** stored secrets couldn't be materialized for this run — not the same as
+     * the user having none. see `RunContext.secretsUnavailable`. */
+    secretsUnavailable?: boolean | undefined;
 }
 interface ResolveRunContextDataParams {
     octokit: OctokitWithPlugins;

package/dist/utils/runStatusCheck.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Single source of truth for the `pullfrog` commit-status check-run — the row a PR's
+ * checks list shows while a run is in flight and after it ends.
+ *
+ * Pullfrog dispatches its workflow with `ref: <default branch>`, so the GitHub Actions
+ * run attaches its check suite to the default branch head and never to the PR head.
+ * Nothing about a run is therefore visible from the PR itself unless we post this
+ * check-run against the PR head sha ourselves.
+ *
+ * Created `in_progress` by the server at dispatch — before the runner boots, and
+ * upstream of every action-side failure that would otherwise leave the PR silent
+ * (billing 402, token resolution, bad model slug, missing provider key). Moved to a
+ * terminal conclusion by whichever of three actors reaches it first, all calling
+ * `finalizeRunStatusCheck`:
+ *
+ *   1. the action at run end (`reportStatusChecks`)
+ *   2. the `workflow_run.completed` webhook (covers cancel / SIGKILL / early throw)
+ *   3. the hourly stuck-run reaper (covers a dropped webhook)
+ *
+ * That three-layer close-out is what makes an `in_progress` check safe here: a check
+ * stranded `in_progress` on a required branch-protection rule would block merges
+ * forever, which is why this file did not exist before.
+ */
+/**
+ * the run-lifecycle check. verdict-agnostic — it reports that a run happened, not what it
+ * found. this string IS the branch-protection identifier, so changing it silently breaks
+ * any repo that required the old name.
+ */
+export declare const RUN_STATUS_CHECK_NAME = "Pullfrog";
+/** the review-verdict check. opt-in, terminal-only, and deliberately separate from the above. */
+export declare const APPROVAL_CHECK_NAME = "Pullfrog approval";
+/**
+ * The terminal states we report. Exactly GitHub's check-run `conclusion` enum, which
+ * happens to be `WorkflowRunStatus` minus `running` — so the server can map a finished
+ * run's status straight across (`checkConclusionFromStatus` in utils/workflowRunStatus.ts).
+ */
+export type RunStatusCheckConclusion = "success" | "failure" | "cancelled" | "timed_out" | "action_required" | "neutral" | "skipped" | "stale";
+/**
+ * Parse the on-the-wire `{ id: string }` shape (the form carried in `JsonPayload`) into
+ * a check-run id. Mirrors `parseProgressComment` — returns undefined when the id isn't a
+ * positive integer so callers can short-circuit cleanly.
+ */
+export declare function parseCheckRunId(raw: {
+    id: string;
+} | null | undefined): number | undefined;
+interface CheckRunResponse {
+    data: {
+        id: number;
+    };
+}
+type CheckRunStatus = "queued" | "in_progress" | "completed";
+type CheckRunOutput = {
+    title: string;
+    summary: string;
+};
+type CreateCheckRunParams = {
+    owner: string;
+    repo: string;
+    name: string;
+    head_sha: string;
+    status?: CheckRunStatus;
+    conclusion?: RunStatusCheckConclusion;
+    details_url?: string;
+    output?: CheckRunOutput;
+};
+type UpdateCheckRunParams = {
+    owner: string;
+    repo: string;
+    check_run_id: number;
+    status?: CheckRunStatus;
+    conclusion?: RunStatusCheckConclusion;
+    details_url?: string;
+    output?: CheckRunOutput;
+};
+export interface RunStatusCheckOctokit {
+    rest: {
+        checks: {
+            create: (params: CreateCheckRunParams) => Promise<CheckRunResponse>;
+            update: (params: UpdateCheckRunParams) => Promise<CheckRunResponse>;
+            get: (params: {
+                owner: string;
+                repo: string;
+                check_run_id: number;
+            }) => Promise<{
+                data: {
+                    status: string;
+                };
+            }>;
+            listForRef: (params: {
+                owner: string;
+                repo: string;
+                ref: string;
+                check_name?: string;
+                status?: "queued" | "in_progress" | "completed";
+            }) => Promise<{
+                data: {
+                    check_runs: {
+                        id: number;
+                    }[];
+                };
+            }>;
+        };
+    };
+}
+/**
+ * Post the `in_progress` check-run on `headSha` and return its id for the finalizers.
+ *
+ * Best-effort: a transient 5xx, a repo that revoked `checks: write`, or a PR whose head
+ * has already been deleted must never stop a run from dispatching. Returns undefined on
+ * failure, which every caller treats as "no check to finalize".
+ */
+export declare function createRunStatusCheck(params: {
+    octokit: RunStatusCheckOctokit;
+    owner: string;
+    repo: string;
+    headSha: string;
+    detailsUrl: string | undefined;
+}): Promise<number | undefined>;
+/**
+ * Move an existing check-run to its terminal conclusion.
+ *
+ * A PATCH, not a second create: `POST /check-runs` with the same name + sha creates a
+ * SECOND row rather than replacing the first, so creating twice would show the PR two
+ * contradictory `pullfrog` rows. (That is a real bug today — `finalizeSuccessRun` posts
+ * success and a later throw posts failure, both as fresh rows.)
+ */
+export declare function finalizeRunStatusCheck(params: {
+    octokit: RunStatusCheckOctokit;
+    owner: string;
+    repo: string;
+    checkRunId: number;
+    conclusion: RunStatusCheckConclusion;
+    detailsUrl: string | undefined;
+    reviewUrl?: string | undefined;
+}): Promise<void>;
+/**
+ * Post an already-terminal check-run in one call.
+ *
+ * The fallback for runs that never got a server-created check to update: a rolling
+ * deploy where the dispatch payload predates `checkRun`, or a workflow invoked outside
+ * Pullfrog's own dispatch path (`prompt_file`, a hand-written step).
+ */
+export declare function createTerminalRunStatusCheck(params: {
+    octokit: RunStatusCheckOctokit;
+    owner: string;
+    repo: string;
+    headSha: string;
+    conclusion: RunStatusCheckConclusion;
+    detailsUrl: string | undefined;
+    reviewUrl?: string | undefined;
+}): Promise<void>;
+/**
+ * Whether this check still needs finalizing.
+ *
+ * The server-side close-outs are BACKSTOPS: they exist for runs the action could not
+ * finalize itself. Firing them unconditionally is actively harmful, because the action
+ * writes a richer summary than they can — it knows the review URL, they do not — so a
+ * blind re-PATCH silently strips that link seconds after it appears. It also resets
+ * `completed_at`, discarding the duration GitHub renders as "Successful in 2m".
+ *
+ * Returns false when GitHub cannot be reached: a backstop that cannot confirm the check
+ * is unfinished must not overwrite a good one.
+ */
+export declare function runStatusCheckNeedsFinalizing(params: {
+    octokit: RunStatusCheckOctokit;
+    owner: string;
+    repo: string;
+    checkRunId: number;
+}): Promise<boolean>;
+export {};

package/dist/utils/statusChecks.d.ts

@@ -1,24 +1,21 @@
 import type { ToolContext } from "../mcp/server.ts";
 /**
- * post the opt-in `pullfrog` (run completion) and `pullfrog-approval` (review
- * verdict) commit-status check-runs so they can be required by branch
- * protection. no-op unless the `status_checks` input is enabled and the run is
- * on a pull request.
+ * post the `Pullfrog` (run lifecycle) and `Pullfrog approval` (review verdict)
+ * commit-status check-runs.
  *
- * terminal-only by design: we never create an `in_progress` check. a
- * hard-cancelled run (SIGKILL) would strand a required check `in_progress` and
- * block merges forever; an absent required check already blocks merge the same
- * way while the run is in flight, with no stuck-check failure mode.
+ *   - `Pullfrog` is on by default (`Repo.statusChecks`). the server already created it
+ *     `in_progress` at dispatch, so the work here is a PATCH to its terminal conclusion —
+ *     see `runStatusCheck.ts` for why a second create would leave two contradictory rows.
+ *     the terminal-create fallback covers a payload with no `checkRun` (older server
+ *     build mid-rolling-deploy, or a workflow driven outside Pullfrog's dispatch path).
+ *   - `Pullfrog approval` stays opt-in (`status_checks: enabled`) and terminal-only:
+ *     it asserts a review verdict, which only exists once a run produces one. anchored
+ *     to the exact reviewed sha so a mid-run push leaves the new head unapproved until
+ *     a follow-up re-review reports.
  *
- *   - `pullfrog` is posted on every PR run: success iff the run finished
- *     successfully, failure on error/timeout. review-verdict-agnostic.
- *   - `pullfrog-approval` is posted only when this run produced an approval
- *     verdict (`toolState.approval`, set by create_pull_request_review),
- *     anchored to the reviewed sha so a mid-run push leaves the new head
- *     unapproved until the follow-up re-review reports.
- *
- * best-effort throughout: a check-post failure (fork PR head not in the base
- * repo, transient 5xx, closed PR) must never flip the run's own outcome.
+ * best-effort throughout: a check-post failure (transient 5xx, closed PR, revoked
+ * permission) must never flip the run's own outcome. the `workflow_run.completed` webhook
+ * and both stuck-run reaper sweeps close out a check this function fails to finalize.
  */
 export declare function reportStatusChecks(ctx: ToolContext, params: {
     runSucceeded: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",