pullfrog 0.1.60 → 0.1.62

package/dist/agents/shared.d.ts

@@ -52,6 +52,16 @@ export declare function hasPostRunIssues(issues: PostRunIssues): boolean;
  * cache hit ratio at a glance. Dashboards that query `WorkflowRun.inputTokens`
  * directly are seeing the full total, not the log column.
  */
+/**
+ * Which credential actually paid for a run.
+ *
+ * `subscription` is the one that changes what a cost figure MEANS: a Claude
+ * Pro/Max or ChatGPT subscription moves no per-token money, so a dollar figure
+ * on such a run is what it WOULD have cost on the API, not spend. Without this
+ * recorded, `WorkflowRun.costUsd` silently mixes the two and there is no way
+ * after the fact to separate them.
+ */
+export type AgentCredential = "subscription" | "api_key" | "gateway" | "bedrock" | "vertex" | "foundry";
 export interface AgentUsage {
     agent: string;
     /** full billable input: non-cached + cache read + cache write */

package/dist/cli.mjs

@@ -107293,6 +107293,9 @@ function isProviderNoRoutableEndpoints(text) {
 function isOpenRouterKeyLimitExceeded(text) {
   return /Key limit exceeded \(total limit\)/i.test(text) || /openrouter\.ai\/[^\s"')]*\/keys\//i.test(text);
 }
+function isProviderMissingCredential(text) {
+  return /API key is missing\. Pass it using the/i.test(text) || /Missing Authentication header/i.test(text);
+}
 function isTransientUpstreamError(text) {
   return /API Error:\s*5\d\d/i.test(text) || /\bOverloaded\b/.test(text) || /"error_type"\s*:\s*"(?:provider_unavailable|timeout)"/i.test(text) || /Streaming response failed:\s*\[5\d\d\]/i.test(text);
 }
@@ -107355,7 +107358,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.60",
+  version: "0.1.62",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -108446,7 +108449,6 @@ function getUnsubmittedReview(toolState, expectsReviewOutput2 = toolState.hadPro
 }
 function expectsReviewOutput(ctx) {
   if (ctx.toolState.hadProgressComment) return true;
-  if (ctx.payload.progressComments) return false;
   return ctx.payload.event.silent !== true && ctx.payload.event.issue_number !== void 0;
 }
 function buildStopHookPrompt(failure2) {
@@ -108661,6 +108663,7 @@ async function runPostRunRetryLoop(params) {
       result = preResume;
       break;
     }
+    if (onlySummaryStale) result = { ...result, output: preResume.output || result.output };
     gateResumeCount++;
   }
   if (gateResumeCount > 0 && result.success && hasPostRunIssues(finalIssues)) {
@@ -109481,6 +109484,19 @@ var claude = agent({
           delete env2.CLAUDE_CODE_OAUTH_TOKEN;
         }
       }
+      if (env2.CLAUDE_CODE_USE_BEDROCK) {
+        ctx.toolState.credential = "bedrock";
+      } else if (env2.CLAUDE_CODE_USE_VERTEX) {
+        ctx.toolState.credential = "vertex";
+      } else if (env2.CLAUDE_CODE_USE_FOUNDRY) {
+        ctx.toolState.credential = "foundry";
+      } else if (env2.ANTHROPIC_AUTH_TOKEN) {
+        ctx.toolState.credential = "gateway";
+      } else if (env2.ANTHROPIC_API_KEY) {
+        ctx.toolState.credential = "api_key";
+      } else if (env2.CLAUDE_CODE_OAUTH_TOKEN) {
+        ctx.toolState.credential = "subscription";
+      }
       const effortEnvOverride = env2[CLAUDE_EFFORT_ENV]?.trim();
       if (effortEnvOverride) {
         log2.warning(
@@ -109943,6 +109959,18 @@ function toTodoWriteInput(item) {
     }))
   };
 }
+var CODEX_MODEL_PRICING = {
+  "gpt-5.6-sol": { input: 5, cacheRead: 0.5, cacheWrite: 6.25, output: 30 },
+  "gpt-5.6-luna": { input: 0.2, cacheRead: 0.02, cacheWrite: 0.25, output: 1.2 },
+  "gpt-5.6-terra": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 12 }
+};
+function codexCostUsd(params) {
+  const price = params.model ? CODEX_MODEL_PRICING[params.model] : void 0;
+  if (!price) return void 0;
+  const fresh = Math.max(0, params.input - params.cacheRead - params.cacheWrite);
+  const usd = (fresh * price.input + params.cacheRead * price.cacheRead + params.cacheWrite * price.cacheWrite + params.output * price.output) / 1e6;
+  return usd > 0 ? usd : void 0;
+}
 async function runCodex2(params) {
   const startTime = performance6.now();
   const thinkingTimer = new ThinkingTimer();
@@ -109954,14 +109982,15 @@ async function runCodex2(params) {
   let turnError = null;
   let lastProviderError = null;
   let stdoutBuffer = "";
-  const tokens = { input: 0, cacheRead: 0, output: 0 };
+  const tokens = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0 };
   function buildUsage2() {
     if (tokens.input === 0 && tokens.output === 0) return void 0;
     return {
       agent: "codex",
       inputTokens: tokens.input,
       outputTokens: tokens.output,
-      cacheReadTokens: tokens.cacheRead || void 0
+      cacheReadTokens: tokens.cacheRead || void 0,
+      costUsd: codexCostUsd({ model: params.model, ...tokens })
     };
   }
   function onItem(item, phase) {
@@ -110026,6 +110055,7 @@ async function runCodex2(params) {
       case "turn.completed":
         tokens.input += event.usage.input_tokens ?? 0;
         tokens.cacheRead += event.usage.cached_input_tokens ?? 0;
+        tokens.cacheWrite += event.usage.cache_write_input_tokens ?? 0;
         tokens.output += event.usage.output_tokens ?? 0;
         return;
       case "turn.failed":
@@ -110186,6 +110216,11 @@ var codex = agent({
     } else if (process.env.OPENAI_API_KEY) {
       env2.CODEX_API_KEY = process.env.OPENAI_API_KEY;
     }
+    if (codexHomeAuth) {
+      ctx.toolState.credential = "subscription";
+    } else if (env2.CODEX_API_KEY) {
+      ctx.toolState.credential = "api_key";
+    }
     const securityFlags = securityOverrideFlags({
       ctx,
       sandboxMode: ctx.payload.push === "disabled" ? "read-only" : "workspace-write",
@@ -110194,7 +110229,13 @@ var codex = agent({
       model: resolveCodexModel(ctx),
       effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
     });
-    const runnerArgs = { cliPath, cwd: process.cwd(), env: env2, todoTracker: ctx.todoTracker };
+    const runnerArgs = {
+      cliPath,
+      cwd: process.cwd(),
+      env: env2,
+      todoTracker: ctx.todoTracker,
+      model: resolveCodexModel(ctx)
+    };
     const initial = await runCodex2({
       ...runnerArgs,
       args: [...securityFlags, "exec", "--json", ctx.instructions.full],
@@ -115967,24 +116008,23 @@ async function installOpencodeCli(params) {
 var AUTO_SELECT_WARNING = "select a model explicitly in the Pullfrog console (https://pullfrog.com/console) to avoid this \u2014 if the picker is locked, this run had no Pullfrog Router funding: add a card or top up your credit.";
 function autoSelectModel() {
   const authorized2 = getAuthorizedModels();
-  if (authorized2.size > 0) {
-    const servable = (a2) => {
-      if (!authorized2.has(a2.resolve)) return false;
-      const envVars = getModelEnvVars(a2.resolve);
-      return envVars.length === 0 || envVars.some((name) => process.env[name]);
-    };
-    const match3 = modelAliases.find((a2) => !a2.hidden && !a2.fallback && a2.preferred && servable(a2)) ?? modelAliases.find((a2) => !a2.hidden && !a2.fallback && servable(a2));
-    if (match3) {
-      log2.info(
-        `\xBB model: ${match3.resolve} (auto-selected${match3.preferred ? " \u2014 preferred" : ""} curated match)`
-      );
-      log2.warning(`\xBB model auto-selected. ${AUTO_SELECT_WARNING}`);
-      return match3.resolve;
-    }
+  const selectable = modelAliases.filter((a2) => !a2.hidden && !a2.fallback && !a2.routing);
+  const servable = selectable.filter((a2) => {
+    const envVars = getModelEnvVars(a2.resolve);
+    return envVars.length === 0 || envVars.some((name) => process.env[name]);
+  });
+  const pick4 = (list) => list.find((a2) => a2.preferred) ?? list[0];
+  const match3 = pick4(servable.filter((a2) => authorized2.has(a2.resolve))) ?? pick4(servable);
+  if (match3) {
     log2.info(
-      `\xBB opencode has ${authorized2.size} models but none match curated aliases \u2014 letting OpenCode auto-select`
+      `\xBB model: ${match3.resolve} (auto-selected${match3.preferred ? " \u2014 preferred" : ""} curated match)`
     );
+    log2.warning(`\xBB model auto-selected. ${AUTO_SELECT_WARNING}`);
+    return match3.resolve;
   }
+  log2.info(
+    `\xBB opencode has ${authorized2.size} models but none match curated aliases and none hold a credential \u2014 letting OpenCode auto-select: ${[...authorized2].join(", ")}`
+  );
   log2.warning(`\xBB no model resolved. letting OpenCode auto-select. ${AUTO_SELECT_WARNING}`);
   return void 0;
 }
@@ -188596,8 +188636,8 @@ function validatePushDestination(repoState, branch, cwd) {
     throw new Error(
       `Push blocked: destination does not match expected repository.
 Expected: ${pushUrl}
-Actual: ${dest.url}
-Git configuration may have been tampered with.`
+Actual: remote '${dest.remoteName}' -> ${dest.url}
+Git configuration may have been tampered with, or a url.*.insteadOf rewrite is in effect.`
     );
   }
   return dest;
@@ -189416,7 +189456,9 @@ var STRING_KEYS = [
   "reviewNodeId",
   "planCommentNodeId",
   "summarySnapshot",
-  "model"
+  "model",
+  "agent",
+  "credential"
 ];
 var NUMBER_KEYS = [
   "inputTokens",
@@ -190717,6 +190759,9 @@ async function configureRepoGit(params) {
   removeIncludeIfEntries(repoDir);
   const originUrl = `https://github.com/${params.owner}/${params.name}.git`;
   $("git", ["remote", "set-url", "origin", originUrl], { cwd: repoDir });
+  $("git", ["config", "--local", "--replace-all", "remote.origin.pushurl", originUrl], {
+    cwd: repoDir
+  });
   repoState.pushUrl = originUrl;
   $("git", ["config", "--local", "credential.helper", ""], { cwd: repoDir });
   repoState.initialHead = captureInitialHead(repoDir);
@@ -191055,6 +191100,9 @@ async function checkoutPrBranch(pr, params) {
       $("git", ["remote", "set-url", remoteName, forkUrl], { log: false });
       log2.debug(`\xBB updated remote '${remoteName}' for fork ${pr.headRepoFullName}`);
     }
+    $("git", ["config", "--local", "--replace-all", `remote.${remoteName}.pushurl`, forkUrl], {
+      log: false
+    });
     $("git", ["config", `branch.${localBranch}.pushRemote`, remoteName], { log: false });
     $("git", ["config", `branch.${localBranch}.merge`, `refs/heads/${pr.headRef}`], { log: false });
     log2.debug(`\xBB configured branch '${localBranch}' to push to '${remoteName}/${pr.headRef}'`);
@@ -196195,7 +196243,10 @@ var JsonPayload = type({
   // optional so a payload from an older server build (pre-`checkRun`) still parses
   // against a newer action across a rolling deploy.
   "checkRun?": type({ id: "string" }).or("undefined"),
-  "generateSummary?": "boolean | undefined"
+  "generateSummary?": "boolean | undefined",
+  // optional so a payload from a pre-canary server build still parses against a
+  // newer action across a rolling deploy.
+  "codexArm?": "boolean | undefined"
 });
 var COLLABORATOR_PERMISSIONS = ["admin", "maintain", "write"];
 function isCollaborator(event) {
@@ -196324,6 +196375,7 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     progressComment: jsonPayload?.progressComment,
     checkRun: jsonPayload?.checkRun,
     generateSummary: jsonPayload?.generateSummary,
+    codexArm: jsonPayload?.codexArm,
     // permissions: inputs > repoSettings > fallbacks
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
@@ -196872,7 +196924,7 @@ async function handleAgentResult(ctx) {
   const mode = toolState.selectedMode;
   const isReviewMode = mode === "Review" || mode === "IncrementalReview";
   const payload = ctx.toolContext.payload;
-  const hasCommentTarget = toolState.hadProgressComment || !payload.progressComments && payload.event.issue_number !== void 0;
+  const hasCommentTarget = toolState.hadProgressComment || payload.event.issue_number !== void 0;
   if (!isReviewMode && !toolState.wasUpdated && hasCommentTarget && !ctx.silent) {
     const tracker = toolState.todoTracker;
     if (tracker) {
@@ -197306,6 +197358,19 @@ ${input.errorMessage}
 \`\`\``
   ].join("\n");
 }
+function formatProviderMissingCredential(input) {
+  return [
+    "**No credential reached the model provider.**",
+    "",
+    "The run started without a key for the provider it ended up using, so the request was refused before any model work happened. Nothing was billed, and no key of yours was rejected \u2014 add a provider key, or pick a model you already have one for.",
+    "",
+    `[Configure model \u2192](${getApiUrl()}/console/${input.owner}/${input.name})`,
+    "",
+    `\`\`\`
+${input.errorMessage}
+\`\`\``
+  ].join("\n");
+}
 function formatProviderModelNotFoundSummary(input) {
   return `The configured model is no longer available in OpenCode's catalog. Pick a different model in the Pullfrog console for \`${input.owner}/${input.name}\`, or contact support if this persists.
 
@@ -197351,6 +197416,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isProviderMissingCredential(input.errorMessage)) {
+    const body = formatProviderMissingCredential({
+      owner: input.repo.owner,
+      name: input.repo.name,
+      errorMessage: input.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   const apiKeySource = hangBody ?? input.errorMessage;
@@ -198268,8 +198343,12 @@ async function main() {
         const agent2 = resolveAgent({
           model: resolvedModel,
           proxyModel: payload.proxyModel,
-          codexAgent: runContext.repoSettings.codexAgent
+          // the account opt-in and the canary arm are both admissions to codex, so
+          // they OR: an account that opted in explicitly always gets it, and the
+          // canary widens the pool without ever demoting a run that already had it.
+          codexAgent: runContext.repoSettings.codexAgent || payload.codexArm === true
         });
+        toolState.agent = agent2.name;
         const effectiveModel = payload.proxyModel ?? resolvedModel ?? payload.model;
         toolState.model = effectiveModel;
         if (!payload.proxyModel) {
@@ -198627,6 +198706,8 @@ ${instructions.user}` : null,
       if (toolContext) {
         const patch = aggregateUsage(toolState.usageEntries);
         if (toolState.model) patch.model = toolState.model;
+        if (toolState.agent) patch.agent = toolState.agent;
+        if (toolState.credential) patch.credential = toolState.credential;
         if (Object.keys(patch).length > 0) {
           await patchWorkflowRunFields(toolContext, patch);
         }
@@ -199184,7 +199265,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.60";
+var VERSION10 = "0.1.62";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);

package/dist/external.d.ts

@@ -322,6 +322,13 @@ export interface WriteablePayload {
     } | undefined;
     /** when true, seed the PR summary tmpfile + persist edits at run end */
     generateSummary?: boolean | undefined;
+    /**
+     * the codex canary assigned this run to the EXPERIMENTAL codex harness. rolled
+     * once server-side at reservation and stamped on the run row, so the row and the
+     * run always agree on which arm this was. ORed with the account opt-in in
+     * `resolveAgent` — it widens who reaches codex, never narrows it.
+     */
+    codexArm?: boolean | undefined;
 }
 export type Payload = Readonly<WriteablePayload>;
 /**

package/dist/index.js

@@ -105126,6 +105126,9 @@ function isProviderNoRoutableEndpoints(text) {
 function isOpenRouterKeyLimitExceeded(text) {
   return /Key limit exceeded \(total limit\)/i.test(text) || /openrouter\.ai\/[^\s"')]*\/keys\//i.test(text);
 }
+function isProviderMissingCredential(text) {
+  return /API key is missing\. Pass it using the/i.test(text) || /Missing Authentication header/i.test(text);
+}
 function isTransientUpstreamError(text) {
   return /API Error:\s*5\d\d/i.test(text) || /\bOverloaded\b/.test(text) || /"error_type"\s*:\s*"(?:provider_unavailable|timeout)"/i.test(text) || /Streaming response failed:\s*\[5\d\d\]/i.test(text);
 }
@@ -105188,7 +105191,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.60",
+  version: "0.1.62",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -106279,7 +106282,6 @@ function getUnsubmittedReview(toolState, expectsReviewOutput2 = toolState.hadPro
 }
 function expectsReviewOutput(ctx) {
   if (ctx.toolState.hadProgressComment) return true;
-  if (ctx.payload.progressComments) return false;
   return ctx.payload.event.silent !== true && ctx.payload.event.issue_number !== void 0;
 }
 function buildStopHookPrompt(failure2) {
@@ -106494,6 +106496,7 @@ async function runPostRunRetryLoop(params) {
       result = preResume;
       break;
     }
+    if (onlySummaryStale) result = { ...result, output: preResume.output || result.output };
     gateResumeCount++;
   }
   if (gateResumeCount > 0 && result.success && hasPostRunIssues(finalIssues)) {
@@ -107314,6 +107317,19 @@ var claude = agent({
           delete env2.CLAUDE_CODE_OAUTH_TOKEN;
         }
       }
+      if (env2.CLAUDE_CODE_USE_BEDROCK) {
+        ctx.toolState.credential = "bedrock";
+      } else if (env2.CLAUDE_CODE_USE_VERTEX) {
+        ctx.toolState.credential = "vertex";
+      } else if (env2.CLAUDE_CODE_USE_FOUNDRY) {
+        ctx.toolState.credential = "foundry";
+      } else if (env2.ANTHROPIC_AUTH_TOKEN) {
+        ctx.toolState.credential = "gateway";
+      } else if (env2.ANTHROPIC_API_KEY) {
+        ctx.toolState.credential = "api_key";
+      } else if (env2.CLAUDE_CODE_OAUTH_TOKEN) {
+        ctx.toolState.credential = "subscription";
+      }
       const effortEnvOverride = env2[CLAUDE_EFFORT_ENV]?.trim();
       if (effortEnvOverride) {
         log.warning(
@@ -107823,6 +107839,18 @@ function toTodoWriteInput(item) {
     }))
   };
 }
+var CODEX_MODEL_PRICING = {
+  "gpt-5.6-sol": { input: 5, cacheRead: 0.5, cacheWrite: 6.25, output: 30 },
+  "gpt-5.6-luna": { input: 0.2, cacheRead: 0.02, cacheWrite: 0.25, output: 1.2 },
+  "gpt-5.6-terra": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 12 }
+};
+function codexCostUsd(params) {
+  const price = params.model ? CODEX_MODEL_PRICING[params.model] : void 0;
+  if (!price) return void 0;
+  const fresh = Math.max(0, params.input - params.cacheRead - params.cacheWrite);
+  const usd = (fresh * price.input + params.cacheRead * price.cacheRead + params.cacheWrite * price.cacheWrite + params.output * price.output) / 1e6;
+  return usd > 0 ? usd : void 0;
+}
 async function runCodex(params) {
   const startTime = performance6.now();
   const thinkingTimer = new ThinkingTimer();
@@ -107834,14 +107862,15 @@ async function runCodex(params) {
   let turnError = null;
   let lastProviderError = null;
   let stdoutBuffer = "";
-  const tokens = { input: 0, cacheRead: 0, output: 0 };
+  const tokens = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0 };
   function buildUsage2() {
     if (tokens.input === 0 && tokens.output === 0) return void 0;
     return {
       agent: "codex",
       inputTokens: tokens.input,
       outputTokens: tokens.output,
-      cacheReadTokens: tokens.cacheRead || void 0
+      cacheReadTokens: tokens.cacheRead || void 0,
+      costUsd: codexCostUsd({ model: params.model, ...tokens })
     };
   }
   function onItem(item, phase) {
@@ -107906,6 +107935,7 @@ async function runCodex(params) {
       case "turn.completed":
         tokens.input += event.usage.input_tokens ?? 0;
         tokens.cacheRead += event.usage.cached_input_tokens ?? 0;
+        tokens.cacheWrite += event.usage.cache_write_input_tokens ?? 0;
         tokens.output += event.usage.output_tokens ?? 0;
         return;
       case "turn.failed":
@@ -108066,6 +108096,11 @@ var codex = agent({
     } else if (process.env.OPENAI_API_KEY) {
       env2.CODEX_API_KEY = process.env.OPENAI_API_KEY;
     }
+    if (codexHomeAuth) {
+      ctx.toolState.credential = "subscription";
+    } else if (env2.CODEX_API_KEY) {
+      ctx.toolState.credential = "api_key";
+    }
     const securityFlags = securityOverrideFlags({
       ctx,
       sandboxMode: ctx.payload.push === "disabled" ? "read-only" : "workspace-write",
@@ -108074,7 +108109,13 @@ var codex = agent({
       model: resolveCodexModel(ctx),
       effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
     });
-    const runnerArgs = { cliPath, cwd: process.cwd(), env: env2, todoTracker: ctx.todoTracker };
+    const runnerArgs = {
+      cliPath,
+      cwd: process.cwd(),
+      env: env2,
+      todoTracker: ctx.todoTracker,
+      model: resolveCodexModel(ctx)
+    };
     const initial = await runCodex({
       ...runnerArgs,
       args: [...securityFlags, "exec", "--json", ctx.instructions.full],
@@ -113847,24 +113888,23 @@ async function installOpencodeCli(params) {
 var AUTO_SELECT_WARNING = "select a model explicitly in the Pullfrog console (https://pullfrog.com/console) to avoid this \u2014 if the picker is locked, this run had no Pullfrog Router funding: add a card or top up your credit.";
 function autoSelectModel() {
   const authorized2 = getAuthorizedModels();
-  if (authorized2.size > 0) {
-    const servable = (a) => {
-      if (!authorized2.has(a.resolve)) return false;
-      const envVars = getModelEnvVars(a.resolve);
-      return envVars.length === 0 || envVars.some((name) => process.env[name]);
-    };
-    const match3 = modelAliases.find((a) => !a.hidden && !a.fallback && a.preferred && servable(a)) ?? modelAliases.find((a) => !a.hidden && !a.fallback && servable(a));
-    if (match3) {
-      log.info(
-        `\xBB model: ${match3.resolve} (auto-selected${match3.preferred ? " \u2014 preferred" : ""} curated match)`
-      );
-      log.warning(`\xBB model auto-selected. ${AUTO_SELECT_WARNING}`);
-      return match3.resolve;
-    }
+  const selectable = modelAliases.filter((a) => !a.hidden && !a.fallback && !a.routing);
+  const servable = selectable.filter((a) => {
+    const envVars = getModelEnvVars(a.resolve);
+    return envVars.length === 0 || envVars.some((name) => process.env[name]);
+  });
+  const pick4 = (list) => list.find((a) => a.preferred) ?? list[0];
+  const match3 = pick4(servable.filter((a) => authorized2.has(a.resolve))) ?? pick4(servable);
+  if (match3) {
     log.info(
-      `\xBB opencode has ${authorized2.size} models but none match curated aliases \u2014 letting OpenCode auto-select`
+      `\xBB model: ${match3.resolve} (auto-selected${match3.preferred ? " \u2014 preferred" : ""} curated match)`
     );
+    log.warning(`\xBB model auto-selected. ${AUTO_SELECT_WARNING}`);
+    return match3.resolve;
   }
+  log.info(
+    `\xBB opencode has ${authorized2.size} models but none match curated aliases and none hold a credential \u2014 letting OpenCode auto-select: ${[...authorized2].join(", ")}`
+  );
   log.warning(`\xBB no model resolved. letting OpenCode auto-select. ${AUTO_SELECT_WARNING}`);
   return void 0;
 }
@@ -186476,8 +186516,8 @@ function validatePushDestination(repoState, branch, cwd) {
     throw new Error(
       `Push blocked: destination does not match expected repository.
 Expected: ${pushUrl}
-Actual: ${dest.url}
-Git configuration may have been tampered with.`
+Actual: remote '${dest.remoteName}' -> ${dest.url}
+Git configuration may have been tampered with, or a url.*.insteadOf rewrite is in effect.`
     );
   }
   return dest;
@@ -187296,7 +187336,9 @@ var STRING_KEYS = [
   "reviewNodeId",
   "planCommentNodeId",
   "summarySnapshot",
-  "model"
+  "model",
+  "agent",
+  "credential"
 ];
 var NUMBER_KEYS = [
   "inputTokens",
@@ -188597,6 +188639,9 @@ async function configureRepoGit(params) {
   removeIncludeIfEntries(repoDir);
   const originUrl = `https://github.com/${params.owner}/${params.name}.git`;
   $("git", ["remote", "set-url", "origin", originUrl], { cwd: repoDir });
+  $("git", ["config", "--local", "--replace-all", "remote.origin.pushurl", originUrl], {
+    cwd: repoDir
+  });
   repoState.pushUrl = originUrl;
   $("git", ["config", "--local", "credential.helper", ""], { cwd: repoDir });
   repoState.initialHead = captureInitialHead(repoDir);
@@ -188935,6 +188980,9 @@ async function checkoutPrBranch(pr, params) {
       $("git", ["remote", "set-url", remoteName, forkUrl], { log: false });
       log.debug(`\xBB updated remote '${remoteName}' for fork ${pr.headRepoFullName}`);
     }
+    $("git", ["config", "--local", "--replace-all", `remote.${remoteName}.pushurl`, forkUrl], {
+      log: false
+    });
     $("git", ["config", `branch.${localBranch}.pushRemote`, remoteName], { log: false });
     $("git", ["config", `branch.${localBranch}.merge`, `refs/heads/${pr.headRef}`], { log: false });
     log.debug(`\xBB configured branch '${localBranch}' to push to '${remoteName}/${pr.headRef}'`);
@@ -194075,7 +194123,10 @@ var JsonPayload = type({
   // optional so a payload from an older server build (pre-`checkRun`) still parses
   // against a newer action across a rolling deploy.
   "checkRun?": type({ id: "string" }).or("undefined"),
-  "generateSummary?": "boolean | undefined"
+  "generateSummary?": "boolean | undefined",
+  // optional so a payload from a pre-canary server build still parses against a
+  // newer action across a rolling deploy.
+  "codexArm?": "boolean | undefined"
 });
 var COLLABORATOR_PERMISSIONS = ["admin", "maintain", "write"];
 function isCollaborator(event) {
@@ -194204,6 +194255,7 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
     progressComment: jsonPayload?.progressComment,
     checkRun: jsonPayload?.checkRun,
     generateSummary: jsonPayload?.generateSummary,
+    codexArm: jsonPayload?.codexArm,
     // permissions: inputs > repoSettings > fallbacks
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
@@ -194752,7 +194804,7 @@ async function handleAgentResult(ctx) {
   const mode = toolState.selectedMode;
   const isReviewMode = mode === "Review" || mode === "IncrementalReview";
   const payload = ctx.toolContext.payload;
-  const hasCommentTarget = toolState.hadProgressComment || !payload.progressComments && payload.event.issue_number !== void 0;
+  const hasCommentTarget = toolState.hadProgressComment || payload.event.issue_number !== void 0;
   if (!isReviewMode && !toolState.wasUpdated && hasCommentTarget && !ctx.silent) {
     const tracker = toolState.todoTracker;
     if (tracker) {
@@ -195186,6 +195238,19 @@ ${input.errorMessage}
 \`\`\``
   ].join("\n");
 }
+function formatProviderMissingCredential(input) {
+  return [
+    "**No credential reached the model provider.**",
+    "",
+    "The run started without a key for the provider it ended up using, so the request was refused before any model work happened. Nothing was billed, and no key of yours was rejected \u2014 add a provider key, or pick a model you already have one for.",
+    "",
+    `[Configure model \u2192](${getApiUrl()}/console/${input.owner}/${input.name})`,
+    "",
+    `\`\`\`
+${input.errorMessage}
+\`\`\``
+  ].join("\n");
+}
 function formatProviderModelNotFoundSummary(input) {
   return `The configured model is no longer available in OpenCode's catalog. Pick a different model in the Pullfrog console for \`${input.owner}/${input.name}\`, or contact support if this persists.
 
@@ -195231,6 +195296,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isProviderMissingCredential(input.errorMessage)) {
+    const body = formatProviderMissingCredential({
+      owner: input.repo.owner,
+      name: input.repo.name,
+      errorMessage: input.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   const apiKeySource = hangBody ?? input.errorMessage;
@@ -196148,8 +196223,12 @@ async function main() {
         const agent2 = resolveAgent({
           model: resolvedModel,
           proxyModel: payload.proxyModel,
-          codexAgent: runContext.repoSettings.codexAgent
+          // the account opt-in and the canary arm are both admissions to codex, so
+          // they OR: an account that opted in explicitly always gets it, and the
+          // canary widens the pool without ever demoting a run that already had it.
+          codexAgent: runContext.repoSettings.codexAgent || payload.codexArm === true
         });
+        toolState.agent = agent2.name;
         const effectiveModel = payload.proxyModel ?? resolvedModel ?? payload.model;
         toolState.model = effectiveModel;
         if (!payload.proxyModel) {
@@ -196507,6 +196586,8 @@ ${instructions.user}` : null,
       if (toolContext) {
         const patch = aggregateUsage(toolState.usageEntries);
         if (toolState.model) patch.model = toolState.model;
+        if (toolState.agent) patch.agent = toolState.agent;
+        if (toolState.credential) patch.credential = toolState.credential;
         if (Object.keys(patch).length > 0) {
           await patchWorkflowRunFields(toolContext, patch);
         }

package/dist/toolState.d.ts

@@ -1,4 +1,4 @@
-import type { AgentUsage } from "./agents/shared.ts";
+import type { AgentCredential, AgentUsage } from "./agents/shared.ts";
 import type { PrepResult } from "./prep/types.ts";
 import type { AgentDiagnostic } from "./utils/agentHangReport.ts";
 import type { DiffCoverageState } from "./utils/diffCoverage.ts";
@@ -136,6 +136,8 @@ export interface ToolState {
     output?: string | undefined;
     usageEntries: AgentUsage[];
     model?: string | undefined;
+    agent?: string | undefined;
+    credential?: AgentCredential | undefined;
     modelFallback?: {
         from: string;
     } | undefined;

package/dist/utils/patchWorkflowRunFields.d.ts

@@ -10,7 +10,7 @@ import type { ToolContext } from "../mcp/server.ts";
  *    don't parse the audit-only `payload`.
  * Keep in sync with `STRING_FIELDS` in `app/api/workflow-run/[runId]/route.ts`.
  */
-declare const STRING_KEYS: readonly ["prNodeId", "issueNodeId", "reviewNodeId", "planCommentNodeId", "summarySnapshot", "model"];
+declare const STRING_KEYS: readonly ["prNodeId", "issueNodeId", "reviewNodeId", "planCommentNodeId", "summarySnapshot", "model", "agent", "credential"];
 /**
  * Number-valued usage fields — aggregated across all agent calls and PATCHed
  * once at end-of-run. Token counts are Int4 on the DB side (ample for any

package/dist/utils/payload.d.ts

@@ -28,6 +28,7 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
         id: string;
     } | undefined;
     generateSummary?: boolean | undefined;
+    codexArm?: boolean | undefined;
 }, {}>;
 export declare const Inputs: import("arktype/internal/variants/object.ts").ObjectType<{
     prompt?: string | undefined;
@@ -75,6 +76,7 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
         id: string;
     } | undefined;
     generateSummary: boolean | undefined;
+    codexArm: boolean | undefined;
     push: import("../external.ts").PushPermission;
     shell: import("../external.ts").ShellPermission;
     runStatusCheck: boolean;

package/dist/utils/providerErrors.d.ts

@@ -50,6 +50,12 @@ export declare function isProviderNoRoutableEndpoints(text: string): boolean;
  * …/settings/credits`) carries no `/keys/` path and correctly stays out.
  */
 export declare function isOpenRouterKeyLimitExceeded(text: string): boolean;
+/**
+ * the provider was reached with NO credential at all — the AI SDK's shared `loadApiKey`
+ * refusal, so it is provider-agnostic. NOT `isApiKeyAuthError`, which is a key we hold
+ * being rejected: "rotate your key" names a credential that does not exist here.
+ */
+export declare function isProviderMissingCredential(text: string): boolean;
 /**
  * The upstream is having a moment: Anthropic's `API Error: 529 Overloaded`,
  * OpenRouter's `provider_unavailable` / `timeout`, OpenCode Zen's `Streaming

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",