pullfrog 0.1.50 → 0.1.52

package/dist/utils/secrets.d.ts

@@ -10,6 +10,11 @@
 export declare const SENSITIVE_PATTERNS: RegExp[];
 export declare function isSensitiveEnvName(key: string): boolean;
 export declare function setEnvAllowlist(raw: string): void;
+/**
+ * `filterEnv()` minus the workflow-command file paths. For subprocesses that
+ * execute third-party code we do not sandbox — the dependency installers.
+ */
+export declare function filterEnvForUntrustedCode(): Record<string, string>;
 /** filter env vars using default-deny allowlist: safe set + user allowlist */
 export declare function filterEnv(): Record<string, string>;
 export type EnvMode = "restricted" | "inherit" | Record<string, string>;

package/dist/utils/setup.d.ts

@@ -53,6 +53,13 @@ export declare function setupTestRepo(options: SetupOptions): void;
 export declare function removeIncludeIfEntries(repoDir: string): void;
 export interface GitContext {
     gitToken: string;
+    /**
+     * re-mint the git token when GitHub's git edge rejects the one we hold. the
+     * fetch path had no re-mint at all, so `checkout_pr` died unrecoverably on a
+     * bad token instance while `push_branch` recovered from the identical
+     * failure. see #1115.
+     */
+    refreshGitToken?: ((stale: string) => Promise<string>) | undefined;
     owner: string;
     name: string;
     octokit: OctokitWithPlugins;

package/dist/utils/statusChecks.d.ts

@@ -8,7 +8,7 @@ import type { ToolContext } from "../mcp/server.ts";
  *     see `runStatusCheck.ts` for why a second create would leave two contradictory rows.
  *     the terminal-create fallback covers a payload with no `checkRun` (older server
  *     build mid-rolling-deploy, or a workflow driven outside Pullfrog's dispatch path).
- *   - `pullfrog-approval` stays opt-in (`status_checks: enabled`) and terminal-only:
+ *   - `pullfrog-approval` stays opt-in (`Repo.approvalCheck`, default off) and terminal-only:
  *     it asserts a review verdict, which only exists once a run produces one. anchored
  *     to the exact reviewed sha so a mid-run push leaves the new head unapproved until
  *     a follow-up re-review reports.

package/dist/utils/worktree.d.ts

@@ -0,0 +1,20 @@
+/** tracked paths with staged or unstaged modifications. */
+export declare function dirtyTrackedPaths(): Promise<Set<string>>;
+/**
+ * discard tracked-file mods that appeared since the `before` snapshot, so the
+ * customer checkout is clean before agent tools run — any dirt makes
+ * `checkout_pr` refuse for the rest of the run. paths already dirty at snapshot
+ * time are left alone, and untracked files (`node_modules`, etc.) are never
+ * touched.
+ *
+ * attribution is by WINDOW, not by writer: every tracked path dirtied while the
+ * window was open gets reverted, whoever wrote it. a caller must therefore close
+ * its window before the agent can write, or it will discard the agent's own work
+ * (#1146 — background prep cannot make that guarantee).
+ *
+ * `actor` names the phase that owns the window and is what the log line blames.
+ */
+export declare function restoreDirtiedSince(params: {
+    before: Set<string>;
+    actor: string;
+}): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",