pullfrog 0.1.55 → 0.1.56

package/dist/internal.js

@@ -247,12 +247,22 @@ var providers = {
     displayName: "DeepSeek",
     envVars: ["DEEPSEEK_API_KEY"],
     models: {
+      // same fork trap as `deepseek-flash` below, and Pro fell into it on
+      // 2026-08-12: OpenRouter forked the 0813 release into its own id and left
+      // the April preview live under the unversioned one at 2.7x the input and
+      // 27x the CACHE-READ rate ($1.168/$2.336/$0.09855 vs
+      // $0.435/$0.87/$0.003625). the direct route upgraded in place, so only the
+      // OpenRouter side was stale — and that side is what OSS and Router runs
+      // use. measured: $0.1719/run authoritative against the funded default's
+      // $0.0405. there is no `~deepseek/*-pro-latest` pointer to track, so this
+      // one has to be a dated pin; the `models-catalog` drift test is what
+      // catches the next release.
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "deepseek/deepseek-v4-pro",
         effort: ["high", "max"],
-        openRouterEffort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro",
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813",
         preferred: true
       },
       // DeepSeek upgrades the `deepseek-v4-flash` API model in place, so the
@@ -260,14 +270,19 @@ var providers = {
       // release into its own id and left the April preview live under the
       // unversioned one at a HIGHER price ($0.14/$0.28 vs $0.09/$0.18) — so the
       // OpenRouter route can never use the bare id. it tracks the rolling
-      // `~deepseek/*-latest` pointer (rule 4), which resolves to 0731 at the
-      // same price today and follows the next in-place upgrade on its own,
-      // rather than pinning a dated snapshot that goes stale every release.
-      // 0731 gained a `low` rung and renamed the top to `max`, unlike Pro
-      // (`high, max` direct / `high, xhigh` via OpenRouter). that ladder now
-      // reads the same on BOTH routes — the in-place direct upgrade caught up
-      // to the fork — so `low`, not `high`, is position 0 either way, which is
-      // why the OSS effort floor in `main.ts` pins the `high` rung by name.
+      // `~deepseek/*-latest` pointer (rule 4), which follows the next in-place
+      // upgrade on its own rather than pinning a dated snapshot that goes stale
+      // every release. that pointer is NOT priced like 0731 — its listed rates
+      // run +40% on output and +57.5% on cache read, and it costs 12% more per
+      // run on authoritative spend ($0.0405 vs $0.0361). kept anyway: ~$45/yr
+      // buys auto-following the upgrade, and the listed gap overstates the real
+      // one because a rolling alias prices at its routing ceiling.
+      // 0731 gained a `low` rung and renamed the top to `max`, and that ladder
+      // now reads the same on BOTH routes — the in-place direct upgrade caught
+      // up to the fork. so `low`, not `high`, is position 0 either way, which is
+      // why the OSS effort floor in `main.ts` pins the `high` rung by name. Pro
+      // is the same shape via OpenRouter since 0813; only its direct route still
+      // starts at `high`.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-v4-flash",
@@ -666,11 +681,13 @@ var providers = {
         effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/x-ai/grok-4.5"
       },
+      // dated pin, not the bare id — see `deepseek/deepseek-pro` for why
+      // OpenRouter's unversioned `deepseek-v4-pro` is the stale April preview.
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
-        resolve: "openrouter/deepseek/deepseek-v4-pro",
-        effort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro"
+        resolve: "openrouter/deepseek/deepseek-v4-pro-0813",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813"
       },
       // rolling pointer, not the bare id — see `deepseek/deepseek-flash` for why
       // OpenRouter's unversioned `deepseek-v4-flash` is the stale April preview.

package/dist/mcp/currentObject.d.ts

@@ -0,0 +1,14 @@
+import type { ToolContext } from "./server.ts";
+export declare const CloseCurrent: import("arktype/internal/variants/object.ts").ObjectType<{
+    state_reason: "completed" | "not_planned" | "duplicate";
+}, {}>;
+export declare function CloseCurrentTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    state_reason: "completed" | "not_planned" | "duplicate";
+}, {
+    state_reason: "completed" | "not_planned" | "duplicate";
+}>> & {
+    mutates?: boolean;
+};
+export declare function ReopenCurrentTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>> & {
+    mutates?: boolean;
+};

package/dist/mcp/gh.d.ts

@@ -0,0 +1,32 @@
+import type { ToolContext } from "./server.ts";
+export declare const GhParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    args: string[];
+}, {}>;
+/**
+ * The GitHub CLI, authenticated with a token scoped to mirror the triggering
+ * user's own repository role (see action/utils/roleMirror.ts).
+ *
+ * Registered only when that mirror yields a token — triage and above. Below
+ * that the object-scoped tools are registered instead, because no GitHub
+ * permission set can express "act only on the object you authored".
+ *
+ * There is deliberately NO subcommand allowlist. `gh auth token` prints its own
+ * credential by design, `GH_DEBUG=api` dumps the Authorization header, and
+ * aliases and extensions are general code execution — so containment of the
+ * TOKEN is not achievable and is not attempted; correct scoping plus revocation
+ * at run end is what makes a leak survivable.
+ *
+ * That last property is exactly why this runs through `runSandboxed` rather
+ * than spawning directly: `gh alias set x '!<shell>'` is arbitrary code
+ * execution, and outside the sandbox it would reach pullfrog-managed on-disk
+ * secrets, the runner's workflow-command files and a writable `.git` — none of
+ * which the token's scope bounds. Inside it, that capability is no more than
+ * the `shell` tool already grants. See wiki/agent-github-access.md.
+ */
+export declare function GhTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    args: string[];
+}, {
+    args: string[];
+}>> & {
+    mutates?: boolean;
+};

package/dist/mcp/issue.d.ts

@@ -18,26 +18,3 @@ export declare function IssueTool(ctx: ToolContext): import("fastmcp").Tool<any,
 }>> & {
     mutates?: boolean;
 };
-export declare const CloseIssue: import("arktype/internal/variants/object.ts").ObjectType<{
-    issue_number: number;
-    state_reason: "completed" | "not_planned" | "duplicate";
-}, {}>;
-export declare function CloseIssueTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
-    issue_number: number;
-    state_reason: "completed" | "not_planned" | "duplicate";
-}, {
-    issue_number: number;
-    state_reason: "completed" | "not_planned" | "duplicate";
-}>> & {
-    mutates?: boolean;
-};
-export declare const ReopenIssue: import("arktype/internal/variants/object.ts").ObjectType<{
-    issue_number: number;
-}, {}>;
-export declare function ReopenIssueTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
-    issue_number: number;
-}, {
-    issue_number: number;
-}>> & {
-    mutates?: boolean;
-};

package/dist/mcp/pr.d.ts

@@ -6,16 +6,6 @@ export declare const PullRequest: import("arktype/internal/variants/object.ts").
     draft?: boolean;
     repo?: string;
 }, {}>;
-export declare const ClosePullRequest: import("arktype/internal/variants/object.ts").ObjectType<{
-    pull_number: number;
-}, {}>;
-export declare function ClosePullRequestTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
-    pull_number: number;
-}, {
-    pull_number: number;
-}>> & {
-    mutates?: boolean;
-};
 export declare const UpdatePullRequestBody: import("arktype/internal/variants/object.ts").ObjectType<{
     pull_number: number;
     body: string;

package/dist/mcp/server.d.ts

@@ -16,6 +16,7 @@ export interface ToolContext {
     gitToken: string;
     refreshGitToken: ((stale: string) => Promise<string>) | undefined;
     readToken: string | undefined;
+    ghToken: string | undefined;
     xrepo: XrepoConfig | undefined;
     apiToken: string;
     modes: Mode[];
@@ -50,6 +51,7 @@ type McpHttpServerOptions = {
  */
 export declare function startMcpHttpServer(ctx: ToolContext, options?: McpHttpServerOptions): Promise<{
     url: string;
+    toolNames: string[];
     [Symbol.asyncDispose]: () => Promise<void>;
 }>;
 export {};

package/dist/mcp/shell.d.ts

@@ -14,6 +14,30 @@ export declare function getSandboxMethod(): SandboxMethod;
  * runners, build tools, grep on large trees), so the overflow is spilled
  * to a tempfile the agent can re-read selectively (cat/tail/grep). */
 export declare const MAX_OUTPUT_CHARS = 5000;
+/** if `output` exceeds `MAX_OUTPUT_CHARS`, persist the full body to a
+ * tempfile and return the last `MAX_OUTPUT_CHARS` prefixed with a sentinel
+ * pointing at the saved path. otherwise return as-is. */
+/**
+ * Run one command inside the mandatory shell sandbox and collect its output.
+ *
+ * Shared by `shell` and `gh` so that agent-initiated process execution carries
+ * the same mount- and PID-namespace guarantees no matter which tool starts it.
+ * A bare `spawnSync` here would escape `PROC_CLEANUP`, `SOCKET_CLEANUP` and
+ * `buildFsMounts` — i.e. the tmpfs over `/var/lib/pullfrog` (codex `auth.json`),
+ * the tmpfs over `$RUNNER_TEMP/_runner_file_commands`, and the `.git` ro-bind —
+ * none of which any token's scope bounds.
+ */
+export declare function runSandboxed(params: {
+    command: string;
+    env: Record<string, string | undefined>;
+    cwd: string;
+    timeout: number;
+}): Promise<{
+    output: string;
+    exitCode: number;
+    timedOut: boolean;
+}>;
+export declare function capOutput(output: string): string;
 export declare function ShellTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     command: string;
     description?: string;

package/dist/utils/billingErrors.d.ts

@@ -56,7 +56,15 @@ export declare function commercialPaywallBody(params: {
     ownerLogin: string;
     url: string;
 }): string;
-/** commercial-gate copy for action runs, linked to the account billing card. */
+/**
+ * commercial-gate copy for action runs, linked to the account billing card.
+ *
+ * if this fires on a `pullfrog/preview-*` repo it is an infrastructure bug, not
+ * a billing state — those repos have no real billing state to refuse. the
+ * original cause was the gate comparing the subscription's originating host
+ * with strict equality, which no preview could satisfy against a cloned
+ * production row; see `isSubscriptionHostTrusted` and wiki/billing-model-v2.md.
+ */
 export declare function formatCommercialGateSummary(params: {
     reason: "commercial" | "subscription_unpaid";
     ownerLogin: string;

package/dist/utils/github.d.ts

@@ -24,7 +24,7 @@ type WriteOnly = "write";
  * @see https://docs.github.com/en/rest/apps/installations#create-an-installation-access-token-for-an-app
  * @see https://github.com/github/rest-api-description — components.schemas.app-permissions
  */
-type GitHubAppPermissions = {
+export type GitHubAppPermissions = {
     actions?: ReadWrite;
     artifact_metadata?: ReadWrite;
     attestations?: ReadWrite;

package/dist/utils/roleMirror.d.ts

@@ -0,0 +1,42 @@
+import type { AuthorPermission } from "../external.ts";
+import type { GitHubAppPermissions } from "./github.ts";
+/**
+ * The installation-token permission set that mirrors the triggering user's own
+ * repository role, or `null` when the role sits below the threshold at which
+ * the agent is handed a GitHub CLI credential at all.
+ *
+ * The invariant this exists to hold: **a leaked run token must never grant more
+ * than the triggering user already has on that repo.** `gh` can print its own
+ * credential (`gh auth token`), dump it via `GH_DEBUG=api`, and reach arbitrary
+ * code through aliases and extensions, so containment is not achievable and is
+ * not attempted — correct scoping plus revocation at run end is what makes a
+ * leak survivable. See wiki/agent-github-access.md.
+ *
+ * The mirror is exact from `triage` up. At `read`/`none` no permission set
+ * expresses "comment, and act only on objects you authored", because GitHub
+ * permissions have no object granularity — so those runs get no token and use
+ * the object-scoped MCP tools instead.
+ *
+ * The set is a strict SUBSET of what any qualifying role holds, so the mirror
+ * is one-directional by construction — it can never over-grant:
+ *
+ * - `contents` is **never** `write`, at any tier. That is what keeps the repo's
+ *   `push` setting meaningful (a `push: "disabled"` repo must not receive a
+ *   write credential by another door) and what keeps `gh pr merge` and
+ *   `gh api` ref writes structurally unavailable — merging is authorized by
+ *   `contents:write`, so withholding it is what makes
+ *   wiki/autonomous-maintenance.md's "no injected instruction can cause a
+ *   merge" still true. Legitimate pushes go through `push_branch`, which
+ *   enforces the branch rules.
+ * - `checks` is absent for the same class of reason: no human role grants it,
+ *   and it would let the agent post its own passing `pullfrog-approval` status
+ *   (see wiki/review-approval.md).
+ * - Every qualifying role therefore receives the SAME set. The role decides
+ *   whether a token is minted at all, not how wide it is — `admin`, `maintain`
+ *   and `write` could not be told apart anyway, because everything that
+ *   separates them needs the `administration` permission the app deliberately
+ *   does not request (see wiki/app-permissions.md).
+ */
+export declare function mirrorRolePermissions(role: AuthorPermission | undefined): GitHubAppPermissions | null;
+/** render a permission set as `contents:write, issues:write` for logs and the prompt. */
+export declare function formatPermissions(permissions: GitHubAppPermissions): string;

package/dist/utils/token.d.ts

@@ -1,4 +1,4 @@
-import type { PushPermission, XrepoConfig } from "../external.ts";
+import type { AuthorPermission, PushPermission, XrepoConfig } from "../external.ts";
 import { acquireNewToken, type OidcCredentials } from "./github.ts";
 export { acquireNewToken as acquireInstallationToken };
 export { revokeGitHubInstallationToken as revokeInstallationToken };
@@ -21,11 +21,13 @@ export type TokenRef = {
     gitToken: string;
     mcpToken: string;
     readToken?: string | undefined;
+    ghToken?: string | undefined;
     refreshGitToken?: ((stale: string) => Promise<string>) | undefined;
     [Symbol.asyncDispose]: () => Promise<void>;
 };
 type ResolveTokensParams = {
     push: PushPermission;
+    authorPermission: AuthorPermission | undefined;
     xrepo?: XrepoConfig | undefined;
     /**
      * OIDC credentials stashed by main.ts before the restricted-mode env wipe —

package/dist/utils/worktree.d.ts

@@ -1,5 +1,16 @@
-/** tracked paths with staged or unstaged modifications. */
-export declare function dirtyTrackedPaths(): Promise<Set<string>>;
+/**
+ * tracked paths with staged or unstaged modifications.
+ *
+ * `cwd` is not optional decoration: the CLI does NOT start inside the checkout.
+ * `runCli.ts` launches it from a bootstrap tmpdir (published) or `actionRoot` (a
+ * tarball action checkout with no `.git`), and `main.ts` only chdirs into the
+ * repo later. A caller that runs before that chdir and relies on `process.cwd()`
+ * gets `exit 129 — Not a git repository` and, since this throws, kills the run:
+ * that is exactly what 0.1.54 did to every customer. Pass the repo dir.
+ */
+export declare function dirtyTrackedPaths(params?: {
+    cwd?: string;
+}): Promise<Set<string>>;
 /**
  * discard tracked-file mods that appeared since the `before` snapshot, so the
  * customer checkout is clean before agent tools run — any dirt makes
@@ -17,4 +28,5 @@ export declare function dirtyTrackedPaths(): Promise<Set<string>>;
 export declare function restoreDirtiedSince(params: {
     before: Set<string>;
     actor: string;
+    cwd?: string;
 }): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.55",
+  "version": "0.1.56",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",