pullfrog 0.1.52 → 0.1.54

package/dist/utils/claudeSubscription.d.ts

@@ -1,7 +1,16 @@
+/**
+ * `status` is the HTTP status Anthropic answered with, or `undefined` when we
+ * never got an answer at all (network failure / timeout). Callers that need to
+ * tell "the credential is dead" from "we couldn't ask" — the paste-time check
+ * in `credentialCheck.ts` — read it; `usable` alone conflates the two, because
+ * fail-open makes both `usable: true`.
+ */
 export type SubscriptionPreflight = {
     usable: true;
+    status: number | undefined;
 } | {
     usable: false;
+    status: number;
     reason: string;
 };
 /**

package/dist/utils/codexOAuth.d.ts

@@ -18,6 +18,17 @@ export interface CodexAuthBody {
         account_id?: string;
     };
     last_refresh?: string;
+    /**
+     * ISO timestamp of an `invalid_grant` rejection. OpenAI rotates the refresh
+     * token on every use, so a rejection is PERMANENT — without a latch the
+     * server re-issued the identical doomed refresh on every run (455 futile
+     * round trips in 7 days, one per run, each holding a Postgres row lock across
+     * a 10s external call). Cleared implicitly: `pullfrog auth codex` and
+     * `PUT /api/runtime/secret` write a fresh blob without it, which re-arms
+     * rotation. Never reaches `auth.json` — `installCodexAuth` builds that file
+     * from explicit fields. See [#1101](https://github.com/pullfrog/app/issues/1101).
+     */
+    refresh_rejected_at?: string;
 }
 /** OAuth client id Codex CLI and OpenCode both use against `auth.openai.com`.
  * Same chain — a refresh token minted via `codex login --device-auth` can be

package/dist/utils/credentialCheck.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What the provider itself says about a credential. `unknown` is the safe
+ * default and covers every outcome that isn't the provider explicitly
+ * rejecting it — no probe for this env var, a network failure, a timeout, a
+ * 404, a 5xx. Callers must treat `unknown` as "carry on as before": only
+ * `dead` is positive evidence, and acting on anything weaker would let a
+ * provider outage rewrite a working account's configuration.
+ */
+export type CredentialVerdict = "alive" | "dead" | "unknown";
+/** whether asking the provider about this credential would tell us anything. */
+export declare function isCredentialProbeable(envVar: string): boolean;
+/**
+ * Ask the provider whether it still accepts this credential. Used at the two
+ * points that were each getting it wrong on their own: the run-time fallback
+ * decision, and the console/CLI paste flow that previously stored a dead token
+ * without comment.
+ */
+export declare function verifyCredential(params: {
+    envVar: string;
+    value: string;
+}): Promise<CredentialVerdict>;

package/dist/utils/credentialFallback.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `ok` covers "the credential works", "we couldn't tell", and "something else
+ * on this model still works" — the run proceeds as it did before this check
+ * existed. The other two are only reached when every credential the configured
+ * model could use has been explicitly rejected by its own provider.
+ *
+ * `replacement` is a concrete model, never a "just auto-select something":
+ * deciding an alternative exists and picking it have to be the SAME decision,
+ * or the picker can land back on the provider that just failed.
+ */
+export type CredentialOutcome = {
+    kind: "ok";
+} | {
+    kind: "fellBack";
+    credential: string;
+    reason: string | undefined;
+    replacement: string;
+} | {
+    kind: "dead";
+    credential: string;
+    reason: string | undefined;
+};
+/**
+ * Ask the providers whether the credentials behind the configured model still
+ * work, BEFORE the agent spawns — so a rejected one becomes either a run on a
+ * model that does work or an accurate error, instead of the agent 401ing three
+ * seconds in against a "rotate your GitHub Actions secret" CTA naming a place
+ * the user never put a key.
+ *
+ * Failed credentials are deleted from `process.env` only when this run can
+ * still proceed without them. Nothing downstream infers anything from that
+ * deletion — `claude.ts` runs its own preflight regardless, because this check
+ * cannot promise it probed any particular token (see its comment for the three
+ * paths that reach it unprobed).
+ *
+ * Only providers in the `credentialCheck` probe table can be found dead; every
+ * other credential is left exactly as it was.
+ */
+export declare function checkConfiguredCredentials(params: {
+    model: string | undefined;
+    authorized: Set<string>;
+}): Promise<CredentialOutcome>;

package/dist/utils/github.d.ts

@@ -1,5 +1,6 @@
 import { throttling } from "@octokit/plugin-throttling";
 import { Octokit } from "@octokit/rest";
+import * as yes from "../yes/index.ts";
 /** GitHub Actions OIDC request credentials, stashed before env wipes */
 export interface OidcCredentials {
     requestUrl: string;
@@ -57,6 +58,18 @@ type AcquireTokenOptions = {
  * as transient.
  */
 export declare function fetchIdTokenFromStash(creds: OidcCredentials): Promise<string>;
+/**
+ * One ID token per run for our single audience. `acquireTokenViaOIDC` runs two
+ * to four times per run (git token, MCP token, xrepo read token) on top of
+ * `resolveRunContextData`'s own mint, and each call used to hit the runner's
+ * OIDC endpoint again — back-to-back requests are exactly what provoked the
+ * Envoy load-shed (`reset reason: overflow`) that killed 19 runs in 24h, all of
+ * them AFTER setup had already succeeded (#1182). The token is valid for
+ * minutes, so the TTL costs nothing; failures are never cached, so a caller's
+ * own retry still re-mints. Mid-run refreshes take the stashed-credentials path
+ * (`opts.oidc`) and deliberately bypass this.
+ */
+export declare const mintIdToken: yes.OpFunction<() => Promise<string>>;
 /**
  * ensure a GitHub token is available in the environment.
  *

package/dist/utils/normalizeEnv.d.ts

@@ -16,6 +16,8 @@
  * value surfaces as a clear "missing key" downstream rather than silently
  * mutating to the empty string.
  */
+/** C0 controls + DEL — the bytes an HTTP header value cannot carry. */
+export declare function hasControlCharacter(value: string): boolean;
 export declare function sanitizeSecret(key: string, value: string): string | null;
 /**
  * Normalize environment variables to uppercase.

package/dist/utils/payload.d.ts

@@ -7,6 +7,7 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
     model?: string | undefined;
     modelExplicit?: boolean | undefined;
     effort?: string | number | undefined;
+    debug?: boolean | undefined;
     triggerer?: string | undefined;
     baseInstructions?: string | undefined;
     eventInstructions?: string;
@@ -33,6 +34,7 @@ export declare const Inputs: import("arktype/internal/variants/object.ts").Objec
     prompt_file?: string | undefined;
     model?: string | undefined;
     effort?: string | undefined;
+    debug?: "disabled" | "enabled" | undefined;
     timeout?: string | undefined;
     push?: "disabled" | "enabled" | "restricted" | undefined;
     shell?: "disabled" | "enabled" | "restricted" | undefined;
@@ -50,6 +52,7 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
     model: string | undefined;
     modelExplicit: boolean;
     effort: number | undefined;
+    debug: true | undefined;
     prompt: string;
     triggerer: string | undefined;
     baseInstructions: string | undefined;

package/dist/utils/providerErrors.d.ts

@@ -1,5 +1,10 @@
 /** Stable label for the BYOK provider-billing-exhausted classification. */
 export declare const PROVIDER_BILLING_EXHAUSTED_LABEL = "provider billing exhausted";
+/** Stable label for "OpenRouter can route this model nowhere you permit". */
+export declare const PROVIDER_NO_ENDPOINTS_LABEL = "provider no routable endpoints";
+export declare function findAnthropicSpendCap(text: string): {
+    regainAt: string | null;
+} | null;
 /**
  * Result of a provider-error scan: the classification label plus a
  * human-readable excerpt centered on the matched line. The excerpt is what
@@ -22,6 +27,44 @@ export declare function isRouterKeylimitExhaustedError(text: string): boolean;
  * is the user's own provider account.
  */
 export declare function isProviderBillingExhausted(text: string): boolean;
+/**
+ * OpenRouter accepted the request and found nowhere to send it: the account's
+ * data policy or guardrail settings exclude every provider serving the picked
+ * model. Nothing is billed and no credential is at fault — the only fix is the
+ * privacy settings page or a different model. See #1164.
+ */
+export declare function isProviderNoRoutableEndpoints(text: string): boolean;
+/**
+ * OpenRouter's per-key ceiling, not an empty wallet. Topping up credits alone
+ * will not clear it, so it needs a different headline and a second lever than
+ * the generic billing-exhausted copy. Both shapes classify as
+ * `PROVIDER_BILLING_EXHAUSTED_LABEL`; this narrows within that class.
+ *
+ * TWO wire forms, and the obvious one is the rarer one. #1071's `Key limit
+ * exceeded (total limit)` names itself; #1164's is the `requires more credits,
+ * or fewer max_tokens` form, which is indistinguishable from a drained wallet
+ * except for the remedy the provider appends — a link to that key's own page.
+ * Anchor on the `/keys/<id>` URL rather than the "adjust the key's total limit"
+ * sentence, because the apostrophe in it arrives from provider JSON and may be
+ * typographic. A genuinely empty wallet (`Insufficient credits. Add more using
+ * …/settings/credits`) carries no `/keys/` path and correctly stays out.
+ */
+export declare function isOpenRouterKeyLimitExceeded(text: string): boolean;
+/**
+ * The upstream is having a moment: Anthropic's `API Error: 529 Overloaded`,
+ * OpenRouter's `provider_unavailable` / `timeout`, OpenCode Zen's `Streaming
+ * response failed: [5xx]`. Three transports, one condition — nothing the user
+ * configured is wrong and the next run will probably work, which is exactly
+ * what the contentless `Run failed.` comment failed to say across 28 runs that
+ * had already done up to 38 tool calls of real work (#1173).
+ *
+ * `error_type` is matched as the machine-readable FIELD it is rather than by
+ * substring-matching the human prose around it, which varies per upstream.
+ * Deliberately narrow on 5xx so it cannot reach a 401/402 that
+ * `isApiKeyAuthError` / `isProviderBillingExhausted` own — and `renderRunError`
+ * orders it after both regardless.
+ */
+export declare function isTransientUpstreamError(text: string): boolean;
 /**
  * Extract `providerID=foo` from agent error logs (OpenCode emits this on
  * `provider error detected (...)` lines). Returns the lowercase provider

package/dist/utils/proxy.d.ts

@@ -15,7 +15,7 @@
  * exist yet at this point in the pipeline.
  *
  *   - 402 → `BillingError` (card declined, balance empty, 3DS, etc.)
- *   - 503 → `TransientError` (transient sync issue — retry next dispatch)
+ *   - 5xx → `TransientError` (the mint is down — retried in-run first)
  *   - 404 → `TransientError` (stale repo↔account link — re-homes on next webhook)
  */
 import type { ToolState } from "../toolState.ts";

package/dist/utils/runContext.d.ts

@@ -76,6 +76,16 @@ export interface RunContext {
      * distinction a transient failure renders as "you have no API key".
      */
     secretsUnavailable?: boolean | undefined;
+    /**
+     * the Router was this account's funding path and its wallet is empty, so the
+     * server declined the mint rather than 402ing — the run falls through to
+     * BYOK, which is the documented affordance for a router-mode account whose
+     * key lives in workflow `env:`. only meaningful when the key search then
+     * comes up dry, where it turns "go add an API key" into copy that also names
+     * topping up. defaults false: an unreachable server must not assert a
+     * funding state. see wiki/billing.md.
+     */
+    routerUnfunded?: boolean | undefined;
 }
 /**
  * fetch run context from Pullfrog API

package/dist/utils/runContextData.d.ts

@@ -17,6 +17,9 @@ export interface RunContextData {
     /** stored secrets couldn't be materialized for this run — not the same as
      * the user having none. see `RunContext.secretsUnavailable`. */
     secretsUnavailable?: boolean | undefined;
+    /** the Router was declined because the wallet is empty. see
+     * `RunContext.routerUnfunded`. */
+    routerUnfunded?: boolean | undefined;
 }
 interface ResolveRunContextDataParams {
     octokit: OctokitWithPlugins;

package/dist/utils/runErrorRenderer.d.ts

@@ -35,6 +35,12 @@
  *      `maximum context length is N tokens`. Actionable, so it renders on
  *      both surfaces rather than collapsing to the one-line comment.
  *
+ *   4c. Transient upstream failure (#1173) — Anthropic `529 Overloaded`,
+ *      OpenRouter `provider_unavailable` / `timeout`, Zen `Streaming response
+ *      failed: [5xx]`. Last of the classified branches so every more specific
+ *      one wins first. Renders on both surfaces: the remedy is re-triggering,
+ *      which the user can only know if we say so.
+ *
  *   5. Activity-timeout hang — `errorMessage` starts with
  *      `"activity timeout"` or `"agent still pending"` AND none of the
  *      above matched. The harness keeps structured diagnostic state on
@@ -52,8 +58,8 @@
  *      the hang case, since the raw internal string helps nobody on the PR.
  *
  * Net: the actionable classifications (billing, API-key, model-not-found,
- * no-provider-available, context-overflow) render identical bodies on both
- * surfaces; the non-actionable ones (hang,
+ * no-provider-available, context-overflow, transient-upstream) render identical
+ * bodies on both surfaces; the non-actionable ones (hang,
  * generic) keep the forensics in the Actions job summary and show a calm
  * one-liner in the PR comment, whose footer already carries Pullfrog
  * branding + rerun links.

package/dist/utils/runStatusCheck.d.ts

@@ -35,11 +35,18 @@ export declare const RUN_STATUS_CHECK_NAME = "pullfrog";
 /** the review-verdict check. opt-in, terminal-only, and deliberately separate from the above. */
 export declare const APPROVAL_CHECK_NAME = "pullfrog-approval";
 /**
- * The terminal states we report. Exactly GitHub's check-run `conclusion` enum, which
- * happens to be `WorkflowRunStatus` minus `running` — so the server can map a finished
- * run's status straight across (`checkConclusionFromStatus` in utils/workflowRunStatus.ts).
+ * The terminal states we report: exactly GitHub's check-run `conclusion` enum.
+ *
+ * NOT `WorkflowRunStatus`. `stale` is a valid `workflow_run.conclusion` and is
+ * NOT a member of the Checks API enum, which GitHub's own 422 enumerates as
+ * `["success", "failure", "neutral", "cancelled", "timed_out",
+ * "action_required", "skipped"]`. Admitting it here let
+ * `checkConclusionFromStatus` type-check while producing a value the wire
+ * always rejects, so 100% of reaper-expired rows failed close-out — and since
+ * the failure left `checkRunId` set, the hourly sweep re-sent the same illegal
+ * conclusion forever. See [#1178](https://github.com/pullfrog/app/issues/1178).
  */
-export type RunStatusCheckConclusion = "success" | "failure" | "cancelled" | "timed_out" | "action_required" | "neutral" | "skipped" | "stale";
+export type RunStatusCheckConclusion = "success" | "failure" | "cancelled" | "timed_out" | "action_required" | "neutral" | "skipped";
 /**
  * Parse the on-the-wire `{ id: string }` shape (the form carried in `JsonPayload`) into
  * a check-run id. Mirrors `parseProgressComment` — returns undefined when the id isn't a
@@ -101,6 +108,9 @@ export interface RunStatusCheckOctokit {
                 data: {
                     check_runs: {
                         id: number;
+                        app?: {
+                            slug?: string | null;
+                        } | null;
                     }[];
                 };
             }>;