pullfrog 0.1.72 → 0.1.73

package/dist/toolState.d.ts

@@ -146,7 +146,6 @@ export interface ToolState {
         from: string;
         reason: "card" | "noRouterPath" | "oss" | "trial";
     } | undefined;
-    shaPinned?: boolean | undefined;
     oss?: boolean | undefined;
     todoTracker?: TodoTracker | undefined;
     agentDiagnostic?: AgentDiagnostic | undefined;

package/dist/utils/buildPullfrogFooter.d.ts

@@ -45,12 +45,6 @@ export interface BuildPullfrogFooterParams {
      * than a frontier model.
      */
     unselectedProxyDefault?: boolean | undefined;
-    /**
-     * true when the action is pinned to a full commit SHA — the footer leads
-     * with a maintenance nudge to switch to the moving `@v0` tag (a SHA pin
-     * freezes the post-run cleanup step, which silently fails the workflow).
-     */
-    shaPinned?: boolean | undefined;
     /**
      * true when the run's model costs are covered by the Pullfrog for OSS
      * program — the footer renders `Using <model> (free via Pullfrog for OSS)`

package/dist/utils/oauthWriteback.d.ts

@@ -0,0 +1,29 @@
+/** GHA state key the agent harnesses write their pending write-backs to.
+ *
+ * `entryPost.ts` gates on the `STATE_oauth_writeback` env var GHA derives from
+ * this name, and it spells the key literally rather than importing this
+ * constant — importing it would drag this module (and `@actions/core`) into the
+ * post-hook's stdlib-only import graph and bring back #815. Keep the two in
+ * sync by hand; `entryPost.stdlibOnly.test.ts` guards the reason they differ. */
+export declare const OAUTH_WRITEBACK_STATE = "oauth_writeback";
+/**
+ * Persist any OAuth refresh chain the run rotated, back into Pullfrog's own
+ * secret store.
+ *
+ * Runs from the action's `post:` hook, which GitHub executes regardless of how
+ * the main step ended — that's the contract this needs: if OpenCode refreshed
+ * the Codex auth.json mid-run, the rotated token must land back in Pullfrog
+ * even when the main step was cancelled or timed out.
+ *
+ * THIS IS WHY `CODEX_AUTH_JSON` HAS TO LIVE IN PULLFROG'S OWN SECRET STORE,
+ * NOT IN GITHUB ACTIONS SECRETS. The refresh chain rotates on every use; this
+ * PUTs the rotated chain back to Pullfrog Postgres so the next run starts from
+ * a fresh token. GH Actions secrets are read-only at runtime — there is no API
+ * to write them back from inside a job — so a token stashed there silently
+ * goes stale on the first refresh and the next run fails. See wiki/codex-auth.md.
+ *
+ * Best-effort throughout: a missed write-back costs the user one
+ * `pullfrog auth codex` re-run, while a throw here would fail a workflow whose
+ * agent already succeeded.
+ */
+export declare function runOAuthWriteback(): Promise<void>;

package/dist/utils/runContextData.d.ts

@@ -34,16 +34,6 @@ interface ResolveRunContextDataParams {
      * model override. */
     runType?: string | undefined;
 }
-/**
- * true when the action is pinned to a full commit SHA (vs the moving `@v0`
- * tag or a branch). GitHub runs the action's `post:` hook (and reads
- * `action.yml`) straight from the checked-out action ref, so a SHA pin freezes
- * that checkout forever: the main agent still floats to the latest `^semver`
- * via the npm bootstrap (this code is proof — it ran), but the post-run
- * cleanup step keeps executing the pinned commit's source and never receives
- * fixes. surfaced in the log and PR footers to nudge repos back to `@v0`.
- */
-export declare function isActionPinnedToSha(): boolean;
 /**
  * initialize run context data: parse context, fetch repo info and settings
  */

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "pullfrog",
-  "version": "0.1.72",
+  "version": "0.1.73",
+  "cliContractVersion": "1",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",
@@ -66,7 +67,8 @@
     "typescript": "^5.9.3",
     "undici": "^7.22.0",
     "vitest": "^4.0.17",
-    "yaml": "^2.8.2"
+    "yaml": "^2.8.2",
+    "zod": "4.3.6"
   },
   "repository": {
     "type": "git",