pullfrog 0.1.65 → 0.1.67

package/dist/internal/index.d.ts

@@ -22,3 +22,5 @@ export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComm
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";
+export type { XaiAuthBody } from "../utils/xaiOAuth.ts";
+export { parseXaiAuthBody, refreshXaiAuthBody, stringifyXaiAuthBody, } from "../utils/xaiOAuth.ts";

package/dist/internal.js

@@ -221,6 +221,11 @@ var providers = {
   xai: provider({
     displayName: "xAI",
     envVars: ["XAI_API_KEY"],
+    // CLI-only, like CODEX_AUTH_JSON: a Grok subscription chain minted by
+    // `pullfrog auth grok`. Excluded from every paste/prompt surface because
+    // the refresh token rotates on every use, so a hand-pasted blob is stale
+    // the moment it is saved. See wiki/grok-auth.md.
+    managedCredentials: ["GROK_AUTH_JSON"],
     models: {
       grok: {
         displayName: "Grok",
@@ -333,6 +338,69 @@ var providers = {
       }
     }
   }),
+  // the same models as `moonshotai` above, billed against a Kimi membership
+  // instead of a Moonshot API balance — a separate endpoint, separate model
+  // ids and a separate key, which is why it is a provider rather than a second
+  // `envVars` entry. no provider injection is needed: models.dev carries
+  // `kimi-for-coding` (api `https://api.kimi.com/coding/v1`, npm
+  // `@ai-sdk/anthropic`) and opencode's env loop enables it from a bare
+  // `KIMI_API_KEY`, verified against our pinned opencode-ai@1.18.5 — all four
+  // ids list in `opencode models` and a run reaches Kimi's own auth check.
+  //
+  // NO `openRouterResolve` ON PURPOSE. OpenRouter cannot serve a Kimi
+  // membership, so a Router path here would silently bill the wallet for
+  // Moonshot pay-as-you-go under a slug picked for the opposite reason. The
+  // absence is load-bearing: `isCardGatedModel` reads it as "not Router-
+  // resolvable", `decideModelAccess` answers an explicit pick with the
+  // `router` copy ("add your own provider key"), and run-context clamps a
+  // keyless Router pick to the default subsidy model with `noRouterPath`.
+  "kimi-for-coding": provider({
+    // "Kimi Code" is the product name on kimi.com/code and in the console the
+    // key is minted from. The provider KEY has to stay `kimi-for-coding` — it
+    // is models.dev's id, so it is what `enabled_providers` and every
+    // `resolve` prefix must spell.
+    displayName: "Kimi Code",
+    envVars: ["KIMI_API_KEY"],
+    models: {
+      // the tier each model needs is in `description` because Kimi answers an
+      // out-of-tier request with 401 — indistinguishable from a bad key by
+      // status alone, and only `isKimiPlanTierError` tells them apart after the
+      // fact. saying it in the picker is the half that stops the run happening.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        description: "1M context, but only on Allegretto and above \xB7 Moderato caps it at 256K",
+        resolve: "kimi-for-coding/k3",
+        effort: ["low", "high", "max"],
+        subagentModel: "kimi-k2"
+      },
+      // `preferred` sits on the 256K variant rather than the 1M flagship, which
+      // inverts the usual "top tier wins" rule for a reason specific to Kimi:
+      // below Allegretto the two are the SAME 256K ceiling and `k3` charges
+      // roughly double the quota for it, so on the median tier the flagship is
+      // strictly dominated rather than merely pricier. This flag seeds the
+      // onboarding pick (`getRecommendedSlug`) and wins key-only auto-select
+      // (`autoSelectModel`), which are exactly the two moments nobody has
+      // chosen yet.
+      "kimi-k3-256k": {
+        displayName: "Kimi K3 256K",
+        description: "Same model at 256K for ~half the quota \xB7 Moderato or above",
+        resolve: "kimi-for-coding/k3-256k",
+        effort: ["low", "high", "max"],
+        preferred: true,
+        subagentModel: "kimi-k2"
+      },
+      "kimi-k2": {
+        displayName: "Kimi K2",
+        description: "Included in every Kimi membership tier",
+        resolve: "kimi-for-coding/kimi-for-coding"
+      },
+      "kimi-k2-highspeed": {
+        displayName: "Kimi K2 HighSpeed",
+        description: "~6x output speed for ~3x quota \xB7 needs Allegretto or above",
+        resolve: "kimi-for-coding/kimi-for-coding-highspeed"
+      }
+    }
+  }),
   opencode: provider({
     displayName: "OpenCode Zen",
     envVars: ["OPENCODE_API_KEY"],
@@ -464,7 +532,13 @@ var providers = {
       },
       "kimi-k2": {
         displayName: "Kimi K2",
-        resolve: "opencode/kimi-k2.7-code",
+        // k2.7-code is UNDEPLOYED on Zen — still listed in /zen/v1/models, but
+        // the endpoint answers 400 `[NOT_FOUND] Model not found, inaccessible,
+        // and/or not deployed` (measured 2026-08-28; k2.6 200 on the same key).
+        // opencode-go is no escape: its own kimi-k2 resolves to the SAME model
+        // id. k2.6 is the newest build Zen will actually serve, and the mirror
+        // guard permits the step down because k2.7-code is in ZEN_UNDEPLOYED.
+        resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
       // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
@@ -879,6 +953,80 @@ var providers = {
         openRouterResolve: "openrouter/minimax/minimax-m3"
       }
     }
+  }),
+  vercel: provider({
+    // Vercel AI Gateway — one key serves every model it fronts. model IDs use
+    // the models.dev `vercel` catalog's own naming (dotted versions, e.g.
+    // `anthropic/claude-opus-5`, `zai/glm-5.3`), and effort ladders mirror that
+    // catalog's entries, not the upstream vendor's. deliberately no
+    // `openRouterResolve`: a gateway pick is BYOK-only — silently rerouting it
+    // over the Router proxy would bill the wallet for traffic the user pointed
+    // at their own gateway.
+    displayName: "Vercel AI Gateway",
+    envVars: ["AI_GATEWAY_API_KEY"],
+    models: {
+      "claude-opus": {
+        displayName: "Claude Opus",
+        resolve: "vercel/anthropic/claude-opus-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        preferred: true,
+        subagentModel: "claude-sonnet"
+      },
+      "claude-sonnet": {
+        displayName: "Claude Sonnet",
+        resolve: "vercel/anthropic/claude-sonnet-5",
+        effort: ["low", "medium", "high", "xhigh"]
+      },
+      "claude-haiku": {
+        displayName: "Claude Haiku",
+        resolve: "vercel/anthropic/claude-haiku-4.5"
+      },
+      "gpt-sol": {
+        displayName: "GPT Sol",
+        resolve: "vercel/openai/gpt-5.6-sol",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        subagentModel: "gpt-terra"
+      },
+      "gpt-terra": {
+        displayName: "GPT Terra",
+        resolve: "vercel/openai/gpt-5.6-terra",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "vercel/openai/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+      },
+      "gemini-pro": {
+        displayName: "Gemini Pro",
+        resolve: "vercel/google/gemini-3.1-pro-preview",
+        effort: ["low", "medium", "high"]
+      },
+      "gemini-flash": {
+        displayName: "Gemini Flash",
+        resolve: "vercel/google/gemini-3.6-flash",
+        effort: ["minimal", "low", "medium", "high"]
+      },
+      "deepseek-pro": {
+        displayName: "DeepSeek Pro",
+        resolve: "vercel/deepseek/deepseek-v4-pro-0813",
+        effort: ["high", "xhigh"]
+      },
+      "deepseek-flash": {
+        displayName: "DeepSeek Flash",
+        resolve: "vercel/deepseek/deepseek-v4-flash",
+        effort: ["high", "xhigh"]
+      },
+      glm: {
+        displayName: "GLM",
+        resolve: "vercel/zai/glm-5.3",
+        effort: ["low", "high", "max"]
+      },
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "vercel/moonshotai/kimi-k3"
+      }
+    }
   })
 };
 function parseModel(slug) {
@@ -1541,17 +1689,48 @@ function stripExistingFooter(body) {
   return body.substring(0, dividerIndex).trimEnd();
 }
 
-// utils/codexOAuth.ts
-var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+// utils/oauthShared.ts
 var OAuthInvalidGrantError = class extends Error {
   status;
-  constructor(status, body) {
-    super(`Codex token refresh failed: ${status} ${body}`);
+  /** whether the provider said this refresh chain is permanently unusable, so
+   * the rotation core may latch it out of use until the user re-mints. */
+  chainIsDead;
+  constructor(provider2, status, body, chainIsDead) {
+    super(`${provider2} token refresh failed: ${status} ${body}`);
     this.name = "OAuthInvalidGrantError";
     this.status = status;
+    this.chainIsDead = chainIsDead;
   }
 };
+function parseOAuthErrorBody(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return null;
+}
+function decodeJwtExpMs(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
+  return payload.exp * 1e3;
+}
+
+// utils/codexOAuth.ts
+var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+function codexChainIsDead(body) {
+  const err = parseOAuthErrorBody(body)?.error;
+  if (!err || typeof err !== "object") return false;
+  return "code" in err && err.code === "token_expired";
+}
 async function refreshCodexAuthBody(body) {
   const response = await fetch(CODEX_OAUTH_TOKEN_URL, {
     method: "POST",
@@ -1566,7 +1745,7 @@ async function refreshCodexAuthBody(body) {
   if (!response.ok) {
     const text = await response.text().catch(() => "");
     if (response.status >= 400 && response.status < 500) {
-      throw new OAuthInvalidGrantError(response.status, text);
+      throw new OAuthInvalidGrantError("Codex", response.status, text, codexChainIsDead(text));
     }
     throw new Error(`Codex token refresh failed: ${response.status} ${text}`);
   }
@@ -1584,18 +1763,6 @@ async function refreshCodexAuthBody(body) {
     last_refresh: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-function decodeJwtExpMs(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  let payload;
-  try {
-    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-  } catch {
-    return null;
-  }
-  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
-  return payload.exp * 1e3;
-}
 function parseCodexAuthBody(raw) {
   let parsed;
   try {
@@ -1869,7 +2036,12 @@ function disableCheckLine(owner, repo) {
   const url = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
   return `
 
-[Turn off this check \u2192](${url}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+This check reports run status only and gates nothing unless you required it in branch protection. [Turn off the run status check \u2192](${url})`;
+}
+function logsLine(detailsUrl) {
+  return detailsUrl ? `
+
+[View the run logs \u2192](${detailsUrl})` : "";
 }
 var TERMINAL_OUTPUT = {
   success: {
@@ -1878,7 +2050,7 @@ var TERMINAL_OUTPUT = {
   },
   failure: {
     title: "Pullfrog run failed",
-    summary: "The Pullfrog run failed. See the run logs for details."
+    summary: "The Pullfrog run failed."
   },
   cancelled: {
     title: "Pullfrog run cancelled",
@@ -1886,11 +2058,11 @@ var TERMINAL_OUTPUT = {
   },
   timed_out: {
     title: "Pullfrog run timed out",
-    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+    summary: "The Pullfrog run exceeded its timeout."
   },
   action_required: {
     title: "Pullfrog run needs attention",
-    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+    summary: "The Pullfrog run stopped and needs attention."
   },
   neutral: {
     title: "Pullfrog run finished",
@@ -1906,8 +2078,11 @@ function terminalOutput(params) {
   const review = params.reviewUrl ? `
 
 [View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
-  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
-  return { title: base.title, summary: base.summary + review + disable };
+  if (params.conclusion === "success") return { title: base.title, summary: base.summary + review };
+  return {
+    title: base.title,
+    summary: base.summary + logsLine(params.detailsUrl) + review + disableCheckLine(params.owner, params.repo)
+  };
 }
 async function createRunStatusCheck(params) {
   const existing = await params.octokit.rest.checks.listForRef({
@@ -1944,6 +2119,7 @@ async function finalizeRunStatusCheck(params) {
       conclusion: params.conclusion,
       owner: params.owner,
       repo: params.repo,
+      detailsUrl: params.detailsUrl,
       reviewUrl: params.reviewUrl
     })
   };
@@ -1977,6 +2153,69 @@ function parseTimeString(input) {
 function isValidTimeString(input) {
   return parseTimeString(input) !== null;
 }
+
+// utils/xaiOAuth.ts
+var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_OAUTH_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+function xaiChainIsDead(body) {
+  return parseOAuthErrorBody(body)?.error === "invalid_grant";
+}
+async function refreshXaiAuthBody(body) {
+  const response = await fetch(XAI_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: body.tokens.refresh_token,
+      client_id: XAI_OAUTH_CLIENT_ID
+    }).toString(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    if (response.status >= 400 && response.status < 500) {
+      throw new OAuthInvalidGrantError("Grok", response.status, text, xaiChainIsDead(text));
+    }
+    throw new Error(`Grok token refresh failed: ${response.status} ${text}`);
+  }
+  const tokens = await response.json();
+  return {
+    auth_mode: "grok",
+    tokens: {
+      access_token: tokens.access_token,
+      // xAI rotates on every use, but tolerate a server that echoes nothing
+      // rather than writing an empty refresh token that bricks the chain.
+      refresh_token: tokens.refresh_token || body.tokens.refresh_token
+    },
+    last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parseXaiAuthBody(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const v = parsed;
+  if (v.auth_mode !== "grok") return null;
+  const tokens = v.tokens;
+  if (!tokens || typeof tokens !== "object") return null;
+  const t = tokens;
+  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
+  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
+  return {
+    auth_mode: "grok",
+    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
+    tokens: { access_token: t.access_token, refresh_token: t.refresh_token },
+    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
+  };
+}
+function stringifyXaiAuthBody(body) {
+  return `${JSON.stringify(body, null, 2)}
+`;
+}
 export {
   APPROVAL_CHECK_NAME,
   AUTO_EFFICIENT,
@@ -2024,9 +2263,11 @@ export {
   parseEffortPosition,
   parseModel,
   parseTimeString,
+  parseXaiAuthBody,
   providers,
   pullfrogMcpName,
   refreshCodexAuthBody,
+  refreshXaiAuthBody,
   resolveAutoTier,
   resolveCliModel,
   resolveDisplayAlias,
@@ -2038,6 +2279,7 @@ export {
   rungLabel,
   rungPosition,
   stringifyCodexAuthBody,
+  stringifyXaiAuthBody,
   stripExistingFooter,
   truncateAtLineBoundary,
   updateProgressComment,

package/dist/models.d.ts

@@ -120,6 +120,7 @@ export declare const providers: {
     xai: ProviderConfig;
     deepseek: ProviderConfig;
     moonshotai: ProviderConfig;
+    "kimi-for-coding": ProviderConfig;
     opencode: ProviderConfig;
     "opencode-go": ProviderConfig;
     bedrock: ProviderConfig;
@@ -127,6 +128,7 @@ export declare const providers: {
     azure: ProviderConfig;
     "openai-compatible": ProviderConfig;
     openrouter: ProviderConfig;
+    vercel: ProviderConfig;
 };
 export type ModelProvider = keyof typeof providers;
 export declare function parseModel(slug: string): {

package/dist/utils/apiKeys.d.ts

@@ -135,6 +135,21 @@ export declare function isMalformedKeyError(text: string): boolean;
  * user controls fixes it, so it gets its own copy instead of the re-auth CTA.
  */
 export declare function isClaudeSubscriptionDisabledError(text: string): boolean;
+/**
+ * Kimi Code entitlement denial — the key is valid and the membership is live,
+ * but the tier doesn't include the model or the context window the run asked
+ * for (`k3` and `k3-256k` need Moderato, `kimi-for-coding-highspeed` and K3's
+ * 1M window need Allegretto). Kimi answers all of them with **401**, the same
+ * status as a revoked key, so nothing but the sentence tells them apart — and
+ * without that the run renders "rotate the key in your provider dashboard",
+ * which names three things that will not fix it.
+ *
+ * Both published shapes, parameterised over the clause that varies rather than
+ * the model id inside it, per `isOAuthCredentialExpiredError`. Listed in
+ * `isApiKeyAuthError` below so the branch is reachable whatever `type` Kimi
+ * puts in the payload. See wiki/kimi-code.md.
+ */
+export declare function isKimiPlanTierError(text: string): boolean;
 export declare function isClaudeSessionLimitError(text: string): boolean;
 /**
  * The provider rejected a credential we checked before the agent started, and

package/dist/utils/codexHome.d.ts

@@ -33,6 +33,27 @@ export interface InstalledCodexAuth {
  * `process.env.XDG_DATA_HOME` so every opencode subprocess discovers the
  * auth.json; no refresh, no DB interaction. */
 export declare function installCodexAuth(): InstalledCodexAuth | null;
+export interface InstalledXaiAuth {
+    /** absolute path of the auth.json we wrote — the post-hook diffs it. */
+    authPath: string;
+    /** value to set as XDG_DATA_HOME for the OpenCode subprocess. */
+    xdgDataHome: string;
+    /** refresh_token at materialization time. opencode's XaiAuthPlugin rotates
+     * in-process on a long run, so the post-hook compares against this to decide
+     * whether anything needs writing back. */
+    originalRefresh: string;
+}
+/** materialize GROK_AUTH_JSON from env into opencode's auth.json.
+ *
+ * opencode ships xAI Grok OAuth natively (`XaiAuthPlugin`, added upstream
+ * 2026-05-21, present in our pinned 1.18.5) against the same public
+ * Grok-CLI OAuth client we mint with, so the stored chain drops straight in.
+ * The plugin sends the token to `api.x.ai/v1` — it deliberately sets no
+ * baseURL — so there is no CLI proxy and no client-version header in play.
+ *
+ * returns null when the env var is absent or malformed; caller treats null as
+ * "no grok subscription auth, fall through to XAI_API_KEY". */
+export declare function installXaiAuth(): InstalledXaiAuth | null;
 export interface InstalledCodexHome {
     /** value to set as CODEX_HOME for the codex subprocess. holds auth.json,
      * config.toml and the session rollouts the resume path reads. */

package/dist/utils/codexOAuth.d.ts

@@ -1,5 +1,5 @@
 /**
- * Pure-stdlib (fetch + Buffer) Codex OAuth refresh + JWT exp decoding.
+ * Pure-stdlib (fetch) Codex OAuth refresh.
  *
  * Lives here (not in codexAuth.ts) so the Next.js server side can import it
  * via pullfrog/internal without dragging in node:child_process / spawn /
@@ -9,6 +9,8 @@
  *
  * See wiki/codex-auth.md for the end-to-end refresh lifecycle.
  */
+import { decodeJwtExpMs, OAuthInvalidGrantError } from "./oauthShared.ts";
+export { decodeJwtExpMs, OAuthInvalidGrantError };
 export interface CodexAuthBody {
     auth_mode: "chatgpt";
     tokens: {
@@ -19,8 +21,10 @@ export interface CodexAuthBody {
     };
     last_refresh?: string;
     /**
-     * ISO timestamp of an `invalid_grant` rejection. OpenAI rotates the refresh
-     * token on every use, so a rejection is PERMANENT — without a latch the
+     * ISO timestamp of a rejection OpenAI attributed to the token itself
+     * (`error.code: "token_expired"` — it does not emit RFC 6749's
+     * `invalid_grant` here). OpenAI rotates the refresh
+     * token on every use, so such a rejection is PERMANENT — without a latch the
      * server re-issued the identical doomed refresh on every run (455 futile
      * round trips in 7 days, one per run, each holding a Postgres row lock across
      * a 10s external call). Cleared implicitly: `pullfrog auth codex` and
@@ -35,13 +39,6 @@ export interface CodexAuthBody {
  * refreshed against this client_id. */
 export declare const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
-/** thrown when the OAuth provider rejects the refresh token (4xx). callers
- * can distinguish "race-lost / token revoked" from network errors via
- * `instanceof OAuthInvalidGrantError`. */
-export declare class OAuthInvalidGrantError extends Error {
-    readonly status: number;
-    constructor(status: number, body: string);
-}
 /** force one refresh round-trip against the OAuth provider. returns the
  * rotated Codex-shaped blob (the auth.json body verbatim). does NOT persist
  * — caller is responsible for writing back to wherever the token lives.
@@ -54,16 +51,6 @@ export declare class OAuthInvalidGrantError extends Error {
  * always releases and queued callers get a turn instead of timing out on
  * the tx wrapper. Real OAuth latency is sub-second; 10s is generous. */
 export declare function refreshCodexAuthBody(body: CodexAuthBody): Promise<CodexAuthBody>;
-/** decode the access_token's JWT payload and return its `exp` claim in ms
- * since epoch. returns null if the token isn't a parseable JWT or has no
- * `exp` claim — caller falls back to "treat as expired".
- *
- * We don't verify the JWT signature (we'd need OpenAI's JWKS); we're only
- * using the claim as a freshness hint. The actual auth check happens
- * server-side at OpenAI when the token is used — trusting a fake JWT here
- * would just delay the inevitable 401 from OpenAI. No security boundary
- * at this decode step. */
-export declare function decodeJwtExpMs(token: string): number | null;
 /** parse + validate a Codex auth.json body from its JSON-string form.
  * returns null on any shape mismatch — caller treats as "no codex auth". */
 export declare function parseCodexAuthBody(raw: string): CodexAuthBody | null;

package/dist/utils/codexRefreshDetect.d.ts

@@ -0,0 +1,44 @@
+/** One provider's post-run writeback plan, handed from the opencode harness to
+ * `entryPost.ts` via `core.saveState`. Type-only across that boundary, so it
+ * does not violate entryPost's stdlib-only import rule. */
+export interface OAuthWriteback {
+    /** Pullfrog secret to PUT the rotated chain back into. */
+    secretName: "CODEX_AUTH_JSON" | "GROK_AUTH_JSON";
+    /** opencode auth.json provider key this chain lives under. */
+    provider: "openai" | "xai";
+    authPath: string;
+    originalRefresh: string;
+    /** codex only — opencode's auth entry has no slot for it. see below. */
+    originalIdToken?: string | undefined;
+}
+/** Detect a mid-run Codex OAuth rotation from an on-disk auth.json and render
+ * it in the Codex CLI shape the Pullfrog secret store holds. Returns null when
+ * the file carries no usable OAuth entry or the refresh token is unchanged from
+ * `originalRefresh`. Lives in its own module so `entryPost.ts` can import it
+ * without pulling in `codexHome.ts` (which imports `./cli.ts` and node fs
+ * helpers).
+ *
+ * Two on-disk shapes reach here, one per harness:
+ *   - codex CLI  — `{auth_mode, tokens: {id_token, access_token, refresh_token}}`,
+ *     already the storage shape, so it round-trips verbatim.
+ *   - opencode   — `{openai: {type: "oauth", access, refresh, accountId}}`, which
+ *     has no slot for `id_token`. The caller passes the pre-run value through
+ *     `originalIdToken` so the rotated blob keeps it: the codex CLI REFUSES an
+ *     auth.json without `tokens.id_token` (`missing field 'id_token'`), so
+ *     dropping it here would silently disqualify the account from ever running
+ *     on the codex harness. `id_token` is an identity claim that a refresh does
+ *     not rotate — the server-side `refreshCodexAuthBody` carries the old one
+ *     forward the same way. */
+export declare function detectCodexRefresh(params: {
+    authFileContent: string;
+    originalRefresh: string;
+    originalIdToken?: string | undefined;
+}): string | null;
+/** Detect a mid-run Grok OAuth rotation and render it in the storage shape.
+ * Simpler than the Codex twin: opencode's `xai` entry carries the whole chain,
+ * there is no second on-disk shape to reconcile and no identity claim to
+ * re-attach. Returns null when the entry is missing or unrotated. */
+export declare function detectXaiRefresh(params: {
+    authFileContent: string;
+    originalRefresh: string;
+}): string | null;

package/dist/utils/github.d.ts

@@ -42,6 +42,12 @@ export type GitHubAppPermissions = {
 };
 type AcquireTokenOptions = {
     repos?: string[] | undefined;
+    /**
+     * handle to the server-persisted cross-repo grant, required whenever `repos`
+     * names anything beyond the primary. the server bounds the request against
+     * the sets IT stored, so this cannot widen the token by itself.
+     */
+    xrepoGrant?: string | undefined;
     permissions?: GitHubAppPermissions;
     /**
      * stashed OIDC credentials for minting after restricted mode deletes

package/dist/utils/oauthShared.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Provider-agnostic OAuth primitives shared by the Codex and Grok chains.
+ * Pure stdlib (Buffer) so both the action runtime and the Next.js server can
+ * import it via pullfrog/internal.
+ *
+ * Both chains mint JWT access tokens whose `exp` we read as a freshness hint,
+ * and both rotate their refresh token on every use — so both need the same
+ * "the provider rejected this permanently" signal.
+ */
+/**
+ * Thrown when an OAuth provider rejects a refresh token (4xx).
+ *
+ * `chainIsDead` is decided by the CALLER, because the two providers we talk to
+ * disagree about how to say it and only the caller knows its own dialect:
+ * xAI answers RFC 6749 (`{"error":"invalid_grant"}`) while OpenAI nests an
+ * object and discriminates on `error.code` (`token_expired`). A rejection we
+ * cannot classify — a CDN error page in front of the token endpoint, say — is
+ * NOT dead: latching there would retire every customer's working credential
+ * over a transient edge event.
+ */
+export declare class OAuthInvalidGrantError extends Error {
+    readonly status: number;
+    /** whether the provider said this refresh chain is permanently unusable, so
+     * the rotation core may latch it out of use until the user re-mints. */
+    readonly chainIsDead: boolean;
+    constructor(provider: string, status: number, body: string, chainIsDead: boolean);
+}
+/** parse a token-endpoint error body, or null when it is not a JSON object.
+ * Each provider's refresh reads its own discriminator out of the result. */
+export declare function parseOAuthErrorBody(body: string): Record<string, unknown> | null;
+/** decode a JWT payload's `exp` claim and return it in ms since epoch.
+ * returns null if the token isn't a parseable JWT or has no `exp` claim —
+ * caller falls back to "treat as expired".
+ *
+ * We don't verify the signature (we'd need the issuer's JWKS); we're only
+ * using the claim as a freshness hint. The real auth check happens at the
+ * provider when the token is used, so trusting a forged JWT here would just
+ * delay the inevitable 401. No security boundary at this decode step. */
+export declare function decodeJwtExpMs(token: string): number | null;

package/dist/utils/payload.d.ts

@@ -19,6 +19,7 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
         write: string[];
         unavailable?: string[];
     } | undefined;
+    xrepoGrant?: string | undefined;
     timeout?: string | undefined;
     progressComment?: {
         id: string;
@@ -66,6 +67,7 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
         write: string[];
         unavailable?: string[];
     } | undefined;
+    xrepoGrant: string | undefined;
     timeout: string | undefined;
     cwd: string | undefined;
     progressComment: {

package/dist/utils/token.d.ts

@@ -29,6 +29,12 @@ type ResolveTokensParams = {
     push: PushPermission;
     authorPermission: AuthorPermission | undefined;
     xrepo?: XrepoConfig | undefined;
+    /**
+     * handle to the cross-repo grant the server persisted for this run. required
+     * alongside `xrepo`: the mint endpoint refuses a `repos` list without one,
+     * because the runner's list is attacker-controlled on a manual dispatch.
+     */
+    xrepoGrant?: string | undefined;
     /**
      * OIDC credentials stashed by main.ts before the restricted-mode env wipe —
      * the mid-run MCP token refresh mints from this snapshot (#891). null when