pullfrog 0.1.53 → 0.1.55

package/dist/internal/index.d.ts

@@ -3,7 +3,7 @@
  * Re-exports shared types, values, and utilities needed by the Next.js app.
  */
 export type { AuthorPermission, AutoTier, EffortPosition, ModelAlias, ModelProvider, Payload, PayloadEvent, ProviderConfig, PushPermission, ShellPermission, ToolPermission, WriteablePayload, XrepoConfig, } from "../external.ts";
-export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
+export { AUTO_EFFICIENT, AUTO_INTELLIGENT, DEFAULT_EFFORT_POSITION, DEFAULT_PROXY_MODEL, defaultAutoTier, EFFORT_ALIASES, getAutoSelectHintModel, getModelEffortLevels, getModelEnvVars, getModelManagedCredentials, getModelProvider, getProviderDisplayName, isAutoTier, isCardGatedModel, isEffortPosition, isOssAllowedModel, modelAliases, modelHasStoredAuth, OSS_MODEL_ALLOWLIST, OSS_RECOMMENDED_MODEL, offeredRungs, ossFundedModelNames, parseEffortPosition, parseModel, providers, pullfrogMcpName, resolveAutoTier, resolveCliModel, resolveDisplayAlias, resolveModelRung, resolveModelSlug, resolveOpenRouterModel, resolveRung, rungLabel, rungPosition, } from "../external.ts";
 export type { Mode } from "../modes.ts";
 export { modes } from "../modes.ts";
 export { commercialPaywallBody } from "../utils/billingErrors.ts";
@@ -11,6 +11,8 @@ export type { BuildPullfrogFooterParams, WorkflowRunFooterInfo, } from "../utils
 export { buildPullfrogFooter, PULLFROG_DIVIDER, stripExistingFooter, } from "../utils/buildPullfrogFooter.ts";
 export type { CodexAuthBody } from "../utils/codexOAuth.ts";
 export { decodeJwtExpMs, OAuthInvalidGrantError, parseCodexAuthBody, refreshCodexAuthBody, stringifyCodexAuthBody, } from "../utils/codexOAuth.ts";
+export type { CredentialVerdict } from "../utils/credentialCheck.ts";
+export { isCredentialProbeable, verifyCredential } from "../utils/credentialCheck.ts";
 export type { ResourceUsage, UsageSummary } from "../utils/github.ts";
 export { isPullfrog } from "../utils/isPullfrog.ts";
 export { isLeapingIntoActionCommentBody, LEAPING_INTO_ACTION_PREFIX, } from "../utils/leapingComment.ts";

package/dist/internal.js

@@ -321,7 +321,12 @@ var providers = {
         displayName: "Big Pickle",
         resolve: "opencode/big-pickle",
         preferred: true,
-        envVars: [],
+        // free to RUN, but Zen still refuses it without a key — a keyless run
+        // dies at session start with `No provider available`. the `envVars: []`
+        // override that used to sit here shadowed the provider's own
+        // `OPENCODE_API_KEY` and made every static gate wave it through (#1077).
+        // `isFree` stays: it is what skips the proxy mint in run-context, and
+        // the model does cost nothing.
         isFree: true
       },
       "claude-opus": {
@@ -443,14 +448,16 @@ var providers = {
       "mimo-v2-pro-free": {
         displayName: "MiMo V2 Pro",
         resolve: "opencode/mimo-v2-pro-free",
-        envVars: [],
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
         isFree: true,
         fallback: "opencode/big-pickle"
       },
       "minimax-m2.5-free": {
         displayName: "MiniMax M2",
         resolve: "opencode/minimax-m2.5-free",
-        envVars: [],
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
         isFree: true,
         fallback: "opencode/big-pickle",
         hidden: true
@@ -646,7 +653,11 @@ var providers = {
       "gemini-flash": {
         displayName: "Gemini Flash",
         resolve: "openrouter/~google/gemini-flash-latest",
-        effort: ["minimal", "low", "medium", "high"],
+        // no `minimal` here, unlike the google/ and opencode/ entries for the
+        // same model: OpenRouter's floating `~google/gemini-flash-latest` stopped
+        // publishing that rung. mirroring it is not cosmetic — claude-code
+        // hard-errors on an out-of-range `--effort` before it calls the API.
+        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/~google/gemini-flash-latest"
       },
       grok: {
@@ -822,10 +833,12 @@ var OSS_MODEL_ALLOWLIST = [
   "deepseek/deepseek-flash",
   "deepseek/deepseek-pro",
   "openai/gpt-luna",
-  "openrouter/minimax-m2.5",
-  "moonshotai/kimi-k2"
+  "openrouter/minimax-m2.5"
 ];
 var OSS_RECOMMENDED_MODEL = AUTO_TIER_TARGET[AUTO_EFFICIENT];
+function ossFundedModelNames() {
+  return OSS_MODEL_ALLOWLIST.map((slug) => resolveDisplayAlias(slug)?.displayName ?? slug);
+}
 var ossAllowedTargets = new Set(
   OSS_MODEL_ALLOWLIST.map((slug) => {
     const target = resolveOpenRouterModel(slug);
@@ -1295,7 +1308,7 @@ function formatModelLabel(params) {
   }
   const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
   if (params.fallbackFrom) {
-    return `${base} (credentials for ${providerDisplayName(params.fallbackFrom)} not configured)`;
+    return `${base} (credentials for ${providerDisplayName(params.fallbackFrom)} were rejected by the provider)`;
   }
   if (params.clamped) {
     const target = isAutoTier(params.clamped.from) ? "the intelligent tier" : `\`${resolveDisplayAlias(params.clamped.from)?.displayName ?? params.clamped.from}\``;
@@ -1423,6 +1436,7 @@ function parseCodexAuthBody(raw) {
   if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
   return {
     auth_mode: "chatgpt",
+    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
     tokens: {
       access_token: t.access_token,
       refresh_token: t.refresh_token,
@@ -1437,6 +1451,109 @@ function stringifyCodexAuthBody(body) {
 `;
 }
 
+// utils/claudeSubscription.ts
+var CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+var fallbackResolve = resolveModelSlug("anthropic/claude-haiku");
+if (!fallbackResolve) {
+  throw new Error("claudeSubscription preflight: anthropic/claude-haiku missing from registry");
+}
+var FALLBACK_PROBE_MODEL = fallbackResolve.slice(fallbackResolve.indexOf("/") + 1);
+async function preflightClaudeSubscription(params) {
+  let res;
+  try {
+    res = await fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${params.token}`,
+        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20",
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json",
+        "x-app": "cli"
+      },
+      body: JSON.stringify({
+        model: params.model ?? FALLBACK_PROBE_MODEL,
+        max_tokens: 1,
+        system: CLAUDE_CODE_IDENTITY,
+        messages: [{ role: "user", content: "ok" }]
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    return { usable: true, status: void 0 };
+  }
+  if (res.status !== 401 && res.status !== 403 && res.status !== 429)
+    return { usable: true, status: res.status };
+  const body = await res.text().catch(() => "");
+  return {
+    usable: false,
+    status: res.status,
+    reason: `${res.status}: ${extractApiErrorMessage(body)}`
+  };
+}
+function extractApiErrorMessage(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed === "object" && parsed !== null && "error" in parsed && typeof parsed.error === "object" && parsed.error !== null && "message" in parsed.error && typeof parsed.error.message === "string") {
+      return parsed.error.message;
+    }
+  } catch {
+  }
+  return body.slice(0, 200);
+}
+
+// utils/credentialCheck.ts
+var PROBES = {
+  ANTHROPIC_API_KEY: {
+    request: (value) => ({
+      url: "https://api.anthropic.com/v1/models",
+      headers: { "x-api-key": value, "anthropic-version": "2023-06-01" }
+    })
+  },
+  OPENROUTER_API_KEY: {
+    request: (value) => ({
+      url: "https://openrouter.ai/api/v1/key",
+      headers: { authorization: `Bearer ${value}` }
+    })
+  },
+  GEMINI_API_KEY: {
+    request: (value) => ({
+      url: `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(value)}`,
+      headers: {}
+    }),
+    deadWhen: (status, body) => status === 400 && body.includes("API_KEY_INVALID")
+  }
+};
+PROBES.GOOGLE_GENERATIVE_AI_API_KEY = PROBES.GEMINI_API_KEY;
+async function verifyClaudeSubscription(value) {
+  const preflight = await preflightClaudeSubscription({ token: value, model: void 0 });
+  if (preflight.status === void 0) return "unknown";
+  return preflight.status === 401 ? "dead" : "alive";
+}
+function isCredentialProbeable(envVar) {
+  return envVar === "CLAUDE_CODE_OAUTH_TOKEN" || envVar in PROBES;
+}
+async function verifyCredential(params) {
+  const value = params.value.trim();
+  if (value.length === 0) return "dead";
+  if (params.envVar === "CLAUDE_CODE_OAUTH_TOKEN") return verifyClaudeSubscription(value);
+  const probe = PROBES[params.envVar];
+  if (!probe) return "unknown";
+  const request = probe.request(value);
+  try {
+    const response = await fetch(request.url, {
+      headers: request.headers,
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (response.ok) return "alive";
+    if (probe.deadWhen) {
+      return probe.deadWhen(response.status, await response.text()) ? "dead" : "unknown";
+    }
+    return response.status === 401 ? "dead" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // utils/isPullfrog.ts
 function isPullfrog(actor) {
   actor = actor?.toLowerCase().replace("[bot]", "");
@@ -1562,6 +1679,7 @@ async function createLeapingProgressComment(ctx, target, body) {
 
 // utils/runStatusCheck.ts
 var RUN_STATUS_CHECK_NAME = "pullfrog";
+var GITHUB_ACTIONS_APP_SLUG = "github-actions";
 var APPROVAL_CHECK_NAME = "pullfrog-approval";
 var IN_PROGRESS_OUTPUT = {
   title: "Pullfrog is running",
@@ -1601,10 +1719,6 @@ var TERMINAL_OUTPUT = {
   skipped: {
     title: "Pullfrog run skipped",
     summary: "This run was superseded by another Pullfrog run."
-  },
-  stale: {
-    title: "Pullfrog run didn't finish",
-    summary: "Pullfrog never received a completion signal for this run. See the run logs for details."
   }
 };
 function terminalOutput(params) {
@@ -1623,7 +1737,9 @@ async function createRunStatusCheck(params) {
     check_name: RUN_STATUS_CHECK_NAME,
     status: "in_progress"
   }).catch(() => void 0);
-  const reusable = existing?.data.check_runs[0];
+  const reusable = existing?.data.check_runs.find(
+    (run) => run.app?.slug !== GITHUB_ACTIONS_APP_SLUG
+  );
   if (reusable) return reusable.id;
   const createParams = {
     owner: params.owner,
@@ -1713,6 +1829,7 @@ export {
   getProviderDisplayName,
   isAutoTier,
   isCardGatedModel,
+  isCredentialProbeable,
   isEffortPosition,
   isLeapingIntoActionCommentBody,
   isOssAllowedModel,
@@ -1722,6 +1839,7 @@ export {
   modelHasStoredAuth,
   modes,
   offeredRungs,
+  ossFundedModelNames,
   parseCodexAuthBody,
   parseEffortPosition,
   parseModel,
@@ -1742,5 +1860,6 @@ export {
   stringifyCodexAuthBody,
   stripExistingFooter,
   truncateAtLineBoundary,
-  updateProgressComment
+  updateProgressComment,
+  verifyCredential
 };

package/dist/mcp/git.d.ts

@@ -32,6 +32,33 @@ export declare function CommitChangesTool(ctx: ToolContext): import("fastmcp").T
 export declare const AUTH_REQUIRED_REDIRECT: Record<string, string>;
 export declare const NOSHELL_BLOCKED_SUBCOMMANDS: Record<string, string>;
 export declare const NOSHELL_BLOCKED_ARGS: string[];
+/**
+ * Two malformed-but-unambiguous shapes the models keep emitting: `args[0]`
+ * repeating the subcommand, and the whole cmdline pushed into `args` behind
+ * `command: "git"`. Both were rejected (or, for the second, run as `git git
+ * log …`) and the models re-emitted the byte-identical call rather than
+ * adapting — 368 dead round trips over 190 runs in 24h (#1199). The intent is
+ * knowable, so normalize rather than reject.
+ *
+ * The promotion out of `command: "git"` re-clears `subcommandPattern`: without
+ * that, `args: ["-c", "alias.x=!evil", "x"]` would move a global git option
+ * into the subcommand slot that pattern exists to guard.
+ */
+export declare function normalizeGitInvocation(input: {
+    command: string;
+    args: string[];
+}): {
+    command: string;
+    args: string[];
+};
+/**
+ * git subcommands whose exit 1 is a documented result rather than a failure.
+ * The status code IS the answer and both streams are empty by design, so
+ * anything that reads "non-zero means broken" reports a successful negative as
+ * an error. See #1152; `merge-base --is-ancestor` keeps its own branch because
+ * it returns a boolean rather than a note.
+ */
+export declare function describeEmptyResult(command: string, args: string[]): string | null;
 export declare function GitTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     command: string;
     args?: string[];

package/dist/mcp/review.d.ts

@@ -189,8 +189,8 @@ export declare const CreatePullRequestReview: import("arktype/internal/variants/
         line: number;
         side?: "LEFT" | "RIGHT";
         body?: string;
-        suggestion?: string;
-        start_line?: number;
+        suggestion?: string | null;
+        start_line?: number | null;
     }[];
 }, {}>;
 export declare function CreatePullRequestReviewTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
@@ -204,8 +204,8 @@ export declare function CreatePullRequestReviewTool(ctx: ToolContext): import("f
         line: number;
         side?: "LEFT" | "RIGHT";
         body?: string;
-        suggestion?: string;
-        start_line?: number;
+        suggestion?: string | null;
+        start_line?: number | null;
     }[];
 }, {
     pull_number: number;
@@ -218,8 +218,8 @@ export declare function CreatePullRequestReviewTool(ctx: ToolContext): import("f
         line: number;
         side?: "LEFT" | "RIGHT";
         body?: string;
-        suggestion?: string;
-        start_line?: number;
+        suggestion?: string | null;
+        start_line?: number | null;
     }[];
 }>> & {
     mutates?: boolean;

package/dist/mcp/reviewComments.d.ts

@@ -1,6 +1,6 @@
 import type { Octokit } from "@octokit/rest";
 import type { ToolContext } from "./server.ts";
-export declare const REVIEW_THREADS_QUERY = "\nquery ($owner: String!, $name: String!, $prNumber: Int!) {\n  repository(owner: $owner, name: $name) {\n    pullRequest(number: $prNumber) {\n      reviewThreads(first: 100) {\n        nodes {\n          id\n          path\n          line\n          startLine\n          diffSide\n          isResolved\n          isOutdated\n          comments(first: 50) {\n            nodes {\n              fullDatabaseId\n              body\n              bodyHTML\n              createdAt\n              diffHunk\n              line\n              startLine\n              originalLine\n              originalStartLine\n              author { login }\n              pullRequestReview {\n                databaseId\n                author { login }\n              }\n              reactionGroups {\n                content\n                reactors(first: 10) {\n                  nodes {\n                    ... on Actor { login }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n";
+export declare const REVIEW_THREADS_QUERY = "\nquery ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {\n  repository(owner: $owner, name: $name) {\n    pullRequest(number: $prNumber) {\n      reviewThreads(first: 100, after: $cursor) {\n        pageInfo { hasNextPage endCursor }\n        nodes {\n          id\n          path\n          line\n          startLine\n          diffSide\n          isResolved\n          isOutdated\n          comments(first: 50) {\n            nodes {\n              fullDatabaseId\n              body\n              bodyHTML\n              createdAt\n              diffHunk\n              line\n              startLine\n              originalLine\n              originalStartLine\n              author { login }\n              pullRequestReview {\n                databaseId\n                author { login }\n              }\n              reactionGroups {\n                content\n                reactors(first: 10) {\n                  nodes {\n                    ... on Actor { login }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n";
 export type ReviewThreadComment = {
     fullDatabaseId: string | null;
     body: string;
@@ -45,6 +45,10 @@ export type ReviewThreadsQueryResponse = {
     repository: {
         pullRequest: {
             reviewThreads: {
+                pageInfo: {
+                    hasNextPage: boolean;
+                    endCursor: string | null;
+                };
                 nodes: (ReviewThread | null)[] | null;
             } | null;
         } | null;

package/dist/models.d.ts

@@ -38,7 +38,10 @@ export interface ModelAlias {
     openRouterResolve: string | undefined;
     /** top-tier pick for this provider — preferred during auto-select */
     preferred: boolean;
-    /** whether this alias is free and requires no API key */
+    /** whether this alias costs nothing to run. NOT the same as needing no
+     * credential: Zen's free models still require `OPENCODE_API_KEY`, and reading
+     * this as "keyless" is what let a keyless run boot onto one and die with
+     * `No provider available` (#1077). used to skip the proxy mint. */
     isFree: boolean;
     /** slug of a replacement model to resolve through. presence means this alias
      * never runs as-is — resolution redirects to the replacement and it's hidden
@@ -122,6 +125,8 @@ export declare function parseModel(slug: string): {
 };
 export declare function getModelProvider(slug: string): string;
 export declare function getProviderDisplayName(slug: string): string | undefined;
+/** provider-prefixed specifier → bare model id (`anthropic/claude-opus-5` → `claude-opus-5`). */
+export declare function stripProviderPrefix(specifier: string): string;
 export declare function getModelEnvVars(slug: string): string[];
 /** managed credentials are authored only via `pullfrog auth <provider>` — they
  * count as "configured" for hasAnyKey-style UI checks but are never offered as
@@ -245,14 +250,27 @@ export declare const DEFAULT_PROXY_MODEL: string;
  * DB toggle — changing it is a deploy, which is the right friction. costs below
  * are modelled on the measured OSS token mix, where cache reads are ~87.5% of
  * input and list price therefore ranks models WRONG: Luna 0.39x, Flash 0.45x,
- * Pro 1.00x, MiniMax M2 1.30x, Kimi 3.88x modelled — but 7.25x as actually
- * measured over the pre-#1063 Kimi era, which is the number to trust.
+ * Pro 1.00x, MiniMax M2 1.30x.
+ *
+ * Kimi K2 was funded and then dropped: 13.2x the funded default as MEASURED
+ * over 2,203 real runs ($0.4782 vs $0.0362), almost entirely on its cache-read
+ * RATE — 8.5x Flash's. it also fails 2.9% of runs against Flash's 0.0%. best
+ * achievable was 10.9x (cheapest OpenRouter endpoint), so no routing fixes it.
+ * see wiki/oss-model-allowlist.md.
  */
 export declare const OSS_MODEL_ALLOWLIST: readonly string[];
 /** the pick the console badges. DERIVED from the efficient tier rather than
  * restated, so the badge cannot drift from the model that actually runs — a
  * second literal here would be an invariant nothing enforces. */
 export declare const OSS_RECOMMENDED_MODEL: string;
+/**
+ * display names of the funded set, in allowlist order. the single place every
+ * surface that NAMES the menu in prose reads it from — the application page,
+ * the acceptance email, the model-access error — so none of them can promise a
+ * model the program stopped funding. callers format the list themselves; this
+ * is a catalog, not copy.
+ */
+export declare function ossFundedModelNames(): string[];
 /**
  * whether an OSS repo's stored pick is one the program funds. resolves through
  * the fallback chain first, so `auto/*` sentinels and deprecated slugs are

package/dist/toolState.d.ts

@@ -148,6 +148,13 @@ export interface ToolState {
     oss?: boolean | undefined;
     todoTracker?: TodoTracker | undefined;
     agentDiagnostic?: AgentDiagnostic | undefined;
+    /**
+     * a `PATCH /api/workflow-run/:id` came back 404 — the reservation was never
+     * claimed, which is permanent for the life of the run (the claim happens at
+     * setup, strictly before any PATCH). latched so the remaining calls stop
+     * firing: one CI run spent 28 doomed round trips on it. see #1153.
+     */
+    workflowRunUnclaimed?: boolean | undefined;
 }
 interface InitToolStateParams {
     progressComment: {

package/dist/utils/apiKeys.d.ts

@@ -5,6 +5,28 @@
  * on our side is the wrong CTA — their key is configured and still stored.
  */
 export declare const SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
+/**
+ * marker for the "your Router wallet is empty AND you have no provider key"
+ * body. its own marker rather than the missing-key one because
+ * `formatApiKeyErrorSummary` rebuilds any body carrying `MISSING_KEY_MARKER`
+ * that doesn't start with it, which would silently discard this copy.
+ */
+export declare const ROUTER_UNFUNDED_MARKER = "your Pullfrog Router balance is empty";
+/**
+ * marker for a credential the provider explicitly REJECTED before the agent
+ * started. needs a verbatim guard for the same reason as its three siblings,
+ * and more sharply: the body quotes the provider's own wording, which is
+ * exactly what `isApiKeyAuthError` sniffs — so an Anthropic error whose JSON
+ * carries `authentication_error` would be rebuilt into the generic
+ * "rotate the key, update the GitHub Actions secret" copy. That is #782
+ * verbatim, on the code path built to stop it.
+ *
+ * Phrased distinctively for the same reason as its siblings: `runErrorRenderer`
+ * short-circuits the whole rendering pipeline on a SUBSTRING match against
+ * arbitrary agent output, so a marker short enough to occur by accident would
+ * hand that agent the ability to suppress every other error body.
+ */
+export declare const CREDENTIAL_REJECTED_MARKER = "was rejected by its provider";
 /**
  * Validate that the resolved model can actually be served by the chosen
  * agent. For routing slugs (Bedrock / Vertex) the auth shape is multi-var
@@ -26,6 +48,7 @@ export declare function validateAgentApiKey(params: {
     /** run-context couldn't hand over Pullfrog-stored secrets, so a missing key
      * says nothing about what the user actually configured. */
     secretsUnavailable?: boolean | undefined;
+    routerUnfunded?: boolean | undefined;
 }): void;
 /**
  * Detect agent-runtime auth failures that should be reformatted as an actionable
@@ -68,6 +91,14 @@ export declare function isApiKeyAuthError(text: string): boolean;
  * expiry can't be misread as an LLM credential problem.
  */
 export declare function isOAuthCredentialExpiredError(text: string): boolean;
+/**
+ * The key itself is unsendable, not wrong: a line-wrapped paste leaves an
+ * interior newline, and the provider SDK refuses to serialize the header
+ * (`API Error: Header '14' has invalid value`). The only member of the
+ * credential-error family whose remedy is NOT "rotate the key" — re-saving the
+ * same value on one line fixes it. See #1162.
+ */
+export declare function isMalformedKeyError(text: string): boolean;
 /**
  * Anthropic entitlement denial for Claude Pro/Max subscription auth (#1072):
  * an org admin turned off Claude Code subscription access. no credential the
@@ -75,6 +106,20 @@ export declare function isOAuthCredentialExpiredError(text: string): boolean;
  */
 export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
 export declare function isClaudeSessionLimitError(text: string): boolean;
+/**
+ * The provider rejected a credential we checked before the agent started, and
+ * nothing else on the account can serve this run. Names the credential and the
+ * place it actually lives, rather than guessing from the provider's wording.
+ */
+export declare function buildRejectedCredentialError(params: {
+    credential: string;
+    /** the provider's own message, when it gave one worth quoting. */
+    reason: string | undefined;
+    owner: string;
+    name: string;
+    /** stored in Pullfrog (console / `pullfrog auth`) rather than a GitHub Actions secret. */
+    inPullfrogStore: boolean;
+}): string;
 /**
  * Friendly Markdown summary for both the missing-key and invalid-key cases.
  * Used in the catch / result-failure paths in `main.ts` to overwrite the raw

package/dist/utils/buildPullfrogFooter.d.ts

@@ -18,10 +18,10 @@ export interface BuildPullfrogFooterParams {
     /** model slug from payload (e.g., "anthropic/claude-opus"). shown in footer as "Using `Model Name`" */
     model?: string | undefined;
     /**
-     * When the action engaged the BYOK fallback, this is the slug the user
-     * had configured (e.g. "anthropic/claude-opus") — the footer renders
-     * `Using <free model> (credentials for <configured> not configured)`
-     * so the substitution is visible in PR comments + reviews.
+     * When a credential was rejected and the run moved to another model, this is
+     * the slug the user had configured (e.g. "anthropic/claude-opus") — the footer
+     * renders `Using <model> (credentials for <configured> were rejected by the
+     * provider)` so the substitution is visible in PR comments + reviews.
      */
     fallbackFrom?: string | undefined;
     /**

package/dist/utils/claudeSubscription.d.ts

@@ -1,7 +1,16 @@
+/**
+ * `status` is the HTTP status Anthropic answered with, or `undefined` when we
+ * never got an answer at all (network failure / timeout). Callers that need to
+ * tell "the credential is dead" from "we couldn't ask" — the paste-time check
+ * in `credentialCheck.ts` — read it; `usable` alone conflates the two, because
+ * fail-open makes both `usable: true`.
+ */
 export type SubscriptionPreflight = {
     usable: true;
+    status: number | undefined;
 } | {
     usable: false;
+    status: number;
     reason: string;
 };
 /**

package/dist/utils/codexOAuth.d.ts

@@ -18,6 +18,17 @@ export interface CodexAuthBody {
         account_id?: string;
     };
     last_refresh?: string;
+    /**
+     * ISO timestamp of an `invalid_grant` rejection. OpenAI rotates the refresh
+     * token on every use, so a rejection is PERMANENT — without a latch the
+     * server re-issued the identical doomed refresh on every run (455 futile
+     * round trips in 7 days, one per run, each holding a Postgres row lock across
+     * a 10s external call). Cleared implicitly: `pullfrog auth codex` and
+     * `PUT /api/runtime/secret` write a fresh blob without it, which re-arms
+     * rotation. Never reaches `auth.json` — `installCodexAuth` builds that file
+     * from explicit fields. See [#1101](https://github.com/pullfrog/app/issues/1101).
+     */
+    refresh_rejected_at?: string;
 }
 /** OAuth client id Codex CLI and OpenCode both use against `auth.openai.com`.
  * Same chain — a refresh token minted via `codex login --device-auth` can be

package/dist/utils/credentialCheck.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What the provider itself says about a credential. `unknown` is the safe
+ * default and covers every outcome that isn't the provider explicitly
+ * rejecting it — no probe for this env var, a network failure, a timeout, a
+ * 404, a 5xx. Callers must treat `unknown` as "carry on as before": only
+ * `dead` is positive evidence, and acting on anything weaker would let a
+ * provider outage rewrite a working account's configuration.
+ */
+export type CredentialVerdict = "alive" | "dead" | "unknown";
+/** whether asking the provider about this credential would tell us anything. */
+export declare function isCredentialProbeable(envVar: string): boolean;
+/**
+ * Ask the provider whether it still accepts this credential. Used at the two
+ * points that were each getting it wrong on their own: the run-time fallback
+ * decision, and the console/CLI paste flow that previously stored a dead token
+ * without comment.
+ */
+export declare function verifyCredential(params: {
+    envVar: string;
+    value: string;
+}): Promise<CredentialVerdict>;

package/dist/utils/credentialFallback.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `ok` covers "the credential works", "we couldn't tell", and "something else
+ * on this model still works" — the run proceeds as it did before this check
+ * existed. The other two are only reached when every credential the configured
+ * model could use has been explicitly rejected by its own provider.
+ *
+ * `replacement` is a concrete model, never a "just auto-select something":
+ * deciding an alternative exists and picking it have to be the SAME decision,
+ * or the picker can land back on the provider that just failed.
+ */
+export type CredentialOutcome = {
+    kind: "ok";
+} | {
+    kind: "fellBack";
+    credential: string;
+    reason: string | undefined;
+    replacement: string;
+} | {
+    kind: "dead";
+    credential: string;
+    reason: string | undefined;
+};
+/**
+ * Ask the providers whether the credentials behind the configured model still
+ * work, BEFORE the agent spawns — so a rejected one becomes either a run on a
+ * model that does work or an accurate error, instead of the agent 401ing three
+ * seconds in against a "rotate your GitHub Actions secret" CTA naming a place
+ * the user never put a key.
+ *
+ * Failed credentials are deleted from `process.env` only when this run can
+ * still proceed without them. Nothing downstream infers anything from that
+ * deletion — `claude.ts` runs its own preflight regardless, because this check
+ * cannot promise it probed any particular token (see its comment for the three
+ * paths that reach it unprobed).
+ *
+ * Only providers in the `credentialCheck` probe table can be found dead; every
+ * other credential is left exactly as it was.
+ */
+export declare function checkConfiguredCredentials(params: {
+    model: string | undefined;
+    authorized: Set<string>;
+}): Promise<CredentialOutcome>;

package/dist/utils/github.d.ts

@@ -1,5 +1,6 @@
 import { throttling } from "@octokit/plugin-throttling";
 import { Octokit } from "@octokit/rest";
+import * as yes from "../yes/index.ts";
 /** GitHub Actions OIDC request credentials, stashed before env wipes */
 export interface OidcCredentials {
     requestUrl: string;
@@ -57,6 +58,18 @@ type AcquireTokenOptions = {
  * as transient.
  */
 export declare function fetchIdTokenFromStash(creds: OidcCredentials): Promise<string>;
+/**
+ * One ID token per run for our single audience. `acquireTokenViaOIDC` runs two
+ * to four times per run (git token, MCP token, xrepo read token) on top of
+ * `resolveRunContextData`'s own mint, and each call used to hit the runner's
+ * OIDC endpoint again — back-to-back requests are exactly what provoked the
+ * Envoy load-shed (`reset reason: overflow`) that killed 19 runs in 24h, all of
+ * them AFTER setup had already succeeded (#1182). The token is valid for
+ * minutes, so the TTL costs nothing; failures are never cached, so a caller's
+ * own retry still re-mints. Mid-run refreshes take the stashed-credentials path
+ * (`opts.oidc`) and deliberately bypass this.
+ */
+export declare const mintIdToken: yes.OpFunction<() => Promise<string>>;
 /**
  * ensure a GitHub token is available in the environment.
  *

package/dist/utils/normalizeEnv.d.ts

@@ -16,6 +16,8 @@
  * value surfaces as a clear "missing key" downstream rather than silently
  * mutating to the empty string.
  */
+/** C0 controls + DEL — the bytes an HTTP header value cannot carry. */
+export declare function hasControlCharacter(value: string): boolean;
 export declare function sanitizeSecret(key: string, value: string): string | null;
 /**
  * Normalize environment variables to uppercase.